mnemospark-lite Cloud File Storage

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:28 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for paid cloud file storage, but it exposes a wallet-scoped bearer credential and gives agents deletion/payment authority without enough safeguards.

Review before installing. Use this only in an environment where the agent is allowed to spend via the configured wallet and access the selected files. Do not let the agent print or persist list_scope_bearer in normal chat or logs; keep it in secret storage or ephemeral memory. Require explicit confirmation before paid uploads, share-link creation, and any delete request, especially bulk deletes. Prefer pinned, reviewed x402 dependencies or an isolated signer/runtime.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:58
• Finding: Unpinned Third-Party Dependency Installed at Runtime## Vulnerability Details **File Location**: `SKILL.md:58` **Vulnerability Type**: Supply-chain exposure through an unpinned runtime dependency **Risk Level**: Medium **Complete Snippet**: ```markdown - if you use the Python x402 client path, install the EVM extras, not only the base package: `pip install 'x402[evm]'` ``` ### Technical Analysis The Skill directs the agent to install `x402[evm]` without an exact version, integrity hash, lockfile, or verified package source. The package and its transitive dependencies can therefore change between executions. Python package installation may also execute build-system hooks or other package-controlled code. This installation is especially sensitive because the dependency is intended to participate in payment signing. Malicious or compromised package code executing in the agent's context could attempt to access wallet material, signed payment payloads, bearer credentials, uploaded files, and other process-accessible data. The finding does not establish that the current `x402` package is malicious. The vulnerability is the mutable and unauthenticated dependency-installation process. ### Attack Path 1. An attacker compromises the selected package, one of its transitive dependencies, or the relevant package distribution channel. 2. The agent follows the Skill and runs `pip install 'x402[evm]'`. 3. The package manager resolves a compromised or unexpectedly changed release because no version or artifact hash is constrained. 4. Package-controlled code executes during installation or later import and use. 5. The code accesses data available to the agent, potentially including wallet credentials, payment authorizations, storage bearer tokens, or selected upload files. 6. The compromised component can disclose those assets or manipulate storage and payment operations. ### Impact Assessment Successful exploitation grants code execution with the privileges of the environment perfo ...[truncated 342 chars]
• Remediation: ## Remediation Suggestions - Pin the dependency and every transitive dependency to reviewed versions. - Require cryptographic hashes for downloaded artifacts, such as through a hash-locked requirements file. - Retrieve packages only from an explicitly trusted repository. - Build and review a locked environment before Skill execution rather than installing packages during a user task. - Run payment tooling in a sandbox with minimal filesystem and network access. - Keep private keys behind a dedicated signer interface so imported dependencies cannot read raw key material. - Continuously scan and periodically re-review the locked dependency set.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:323
• Finding: Wallet-Scoped Bearer Credential May Be Returned or Insecurely Persisted## Vulnerability Details **File Location**: `SKILL.md:323-330` **Vulnerability Type**: Sensitive credential exposure through output or unspecified persistence **Risk Level**: High **Complete Snippet**: ```markdown ## Output expectations Return or persist the most useful fields for the active task: - `uploadId` - `publicUrl` - `siteUrl` - `shareUrl` when minted separately - `list_scope_bearer` - `metadata.payment.status` when present - `metadata.payment.transactionHash` when present - `metadata.payment.success` when present ``` Related credential scope is documented at `SKILL.md:233-248`: ```markdown When the user wants to see uploads for the payer scope, call: - `GET ${MNEMOSPARK_API_BASE_URL}/api/mnemospark-lite/uploads` - `Authorization: Bearer <token>` You typically receive the token as `list_scope_bearer` from the paid upload flow. Expect `data.uploads[]` fields such as: - `id` - `filename` - `contentType` - `tier` - `maxSize` - `actualSize` - `publicUrl` - `status` - `pricePaid` - `expiresAt` - `createdAt` Notes: - bearer scope is tied to the payer wallet - `publicUrl` may be `null` until `/upload/complete` - treat bearer tokens as credentials and store them appropriately for the runtime ``` ### Technical Analysis The Skill explicitly permits the agent to “return or persist” `list_scope_bearer`. This value is an authorization credential used for wallet-scoped list, download, share, and delete operations. Returning it in ordinary agent output can expose it through conversation history, telemetry, debugging output, or logs. Persisting it without a mandated secret-storage mechanism, restrictive permissions, redaction, retention limit, or revocation policy creates a similar disclosure risk. The documentation recognizes the value as a credential but does not reconcile that requirement with the later instruction to return it. Public URLs and operation results can be ret ...[truncated 1137 chars]
• Remediation: ## Remediation Suggestions - Remove `list_scope_bearer` from user-visible output expectations. - Store the token only in an approved secret manager or credential vault. - Persist only an opaque credential reference where downstream operations need reuse. - Prohibit bearer values in chat transcripts, command output, telemetry, exception messages, and logs. - Apply automatic redaction to authorization headers and response fields containing tokens. - Enforce restrictive filesystem permissions if local secret persistence is unavoidable. - Define token expiration, rotation, revocation, and minimum-retention policies. - Prefer narrower per-operation or per-upload tokens over a wallet-wide bearer scope where the service supports them. - Return only non-secret results such as `uploadId`, status, public or explicitly requested share URLs, and payment transaction status.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Use this skill to operate mnemospark-lite from OpenClaw.

**mnemospark-lite** gives any agent access to cloud storage through a simple paid HTTP workflow. Agents can upload files, list stored files, delete files, and generate shareable links that can be passed to another agent or a human. Humans can use the web app at **[https://app.mnemospark.ai/mnemospark-lite](https://app.mnemospark.ai/mnemospark-lite)** to view files, download them, delete them, and create share links from a friendly UI. It’s the same storage system, designed to work cleanly for both agents and people. Files are retained for 30 days and then automatically deleted.

## Workflow summary

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

External Transmission

Medium

• Category: Data Exfiltration

Content

}
  },
  "resource": {
    "url": "https://api.mnemospark.ai/api/mnemospark-lite/upload",
    "mimeType": "application/json",
    "description": "mnemospark-lite upload"
  },

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill enables deletion of uploads but provides no requirement for explicit user confirmation, dry-run review, or safeguards against accidental bulk deletion. In an agentic environment, destructive API actions without confirmation can cause unintended data loss if the agent misinterprets user intent or acts on ambiguous identifiers.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The skill advises treating bearer tokens as credentials and storing them appropriately, but it lacks concrete restrictions on persistence, scope minimization, redaction, or user notice. If an agent stores `list_scope_bearer` insecurely or exposes it in logs, another party could access wallet-scoped upload, download, share, or delete operations.

Static analysis

No suspicious patterns detected.