Security audit

Lancedb Memory

Security checks for vulnerabilities and agentic risk

Overview

This local memory skill is purpose-aligned, but it creates persistent storage in a hard-coded path on load and lacks clear user controls for consent, retention, and deletion.

Review this skill before installing if you expect memory to be ephemeral or sensitive. It can retain whatever content callers add to memory on disk, uses a fixed local path, and lacks built-in consent, redaction, retention, encryption, confirmation, or recovery controls.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:66
Finding: LanceDB Filter Expression Injection Through Unsanitized Category Input
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: final_memory.py:73
Finding: Regular-Expression Injection in Final Memory Search
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: simple_memory.py:60
Finding: Regular-Expression Injection in Simple Memory Search
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: working_memory.py:64
Finding: Regular-Expression Injection in Working Memory Search
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill initializes a persistent database under a hard-coded local path and creates the storage directory automatically, but provides no user-facing disclosure or consent mechanism that data will be written to disk. In an agent skill context, long-term memory can capture sensitive prompts, secrets, or personal data, so silent persistence materially increases privacy and data-retention risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The delete operation removes records immediately by ID with no confirmation, preview, or user-visible warning. In a memory-management skill, this can lead to accidental or induced deletion of important long-term data, reducing integrity and recoverability, especially if called by higher-level automation without human review.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The module persists arbitrary memory content and metadata to a local LanceDB path automatically, with no consent prompt, disclosure, retention control, or indication that potentially sensitive user data will be stored on disk. In an agent memory context, this can silently capture prompts, personal data, secrets, or conversation history and leave them recoverable from local storage by other users, backups, or forensic access.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The schema documentation in _create_memory_table says it creates a Clawdbot-compatible schema with metadata defined as pa.string(), implying string storage. However, add_memory later inserts metadata or {} as a dictionary at L071, which contradicts the declared schema intent rather than merely omitting detail.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The module persists memory content and metadata to a local on-disk database automatically, with no consent, disclosure, retention controls, or sensitivity filtering. If this memory contains prompts, secrets, personal data, or tokens, it can create unintended data retention and local disclosure risk, especially because a global instance is initialized at import time and writes to a fixed user path.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The code persists arbitrary content and metadata to a local on-disk database without any consent, disclosure, retention controls, or filtering of sensitive data. In an agent skill context, users may provide secrets, personal data, or conversation content expecting ephemeral use, so silently storing it creates privacy and data-handling risk if the host is shared, backed up, or later accessed by other components.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The module exposes async methods for search and add, but the __main__ test block calls them without await, so it receives coroutine objects instead of actually searching or adding memories. This contradicts the test's printed messages such as 'Testing Clawdbot Memory Integration...' and 'integration ready', which imply the integration was exercised successfully.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.