ClawHub
Back to skill

Security audit

memic

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate Memic SDK guide, but it needs review because it encourages sending documents, database data, and RAG context to hosted services without enough safety guidance.

Review this before installing in sensitive environments. Use a virtual environment, pin and review the `memic` package version, upload only approved or sanitized documents, avoid secrets and regulated data unless your organization has approved Memic's retention and access controls, use least-privilege read-only database credentials for connectors, and keep retrieved document text out of system/developer prompts.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:40
Finding

Unpinned Third-Party Package Installation Creates a Supply-Chain Risk

Content
View full analysis
Remediation
View remediation
``` Install it with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Lock all transitive dependencies using a reviewed lock file rather than resolving unrestricted versions at installation time. 4. Keep the dependency pin synchronized with the Skill metadata and repeat the pinned command consistently at every installation reference. 5. Review release provenance, package ownership, and source repository tags before updating the pinned version. 6. Install and run the SDK in an isolated virtual environment or container under a non-privileged account. 7. Provide the minimum required environment variables to the process and avoid colocating unrelated credentials in the same runtime. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:251
Finding

Retrieved Document Content Is Injected into an Authoritative LLM Prompt

Content
View full analysis
str: # 1. Get relevant context from Memic results = memic.search(query=question, top_k=5, min_score=0.6) # 2. Format as LLM context context = "\n\n".join([ f"[Source: {r.file_name}, Page {r.page_number}]\n{r.content}" for r in results ]) # 3. Generate grounded response response = llm.chat.completions.create( model="gpt-4o", messages=[ {"role": "system", "content": f"Answer based on this context:\n\n{context}"}, {"role": "user", "content": question} ] ) ``` A related example places the retrieved content and question into one undifferentiated prompt: ```python def get_context(question: str) -> str: """Get relevant context from your documents for an LLM prompt.""" results = memic.search(query=question, top_k=5, min_score=0.6) return "\n\n".join([ f"[{r.file_name}, Page {r.page_number}]\n{r.content}" for r in results ]) # Use with any LLM context = get_context("What are the contract renewal terms?") prompt = f"Answer based on this context:\n\n{context}\n\nQuestion: What are the contract renewal terms?" ``` ### Technical Analysis Search result content originates from uploaded documents or other indexed sources and must be treated as untrusted data. The primary integration example interpolates this content directly into the `system` message, which is normally the most authoritative instruction channel exposed by the API. The alternate example combines retrieved content and the user's question in a single plain-text prompt without a trust boundary. An attacker who can create or modify an indexed document can embed instructions ...[truncated 2371 chars]
Remediation
View remediation
\n" f"{r.content}\n" for r in results ) response = llm.chat.completions.create( model="gpt-4o", messages=[ {"role": "system", "content": trusted_policy}, { "role": "user", "content": ( f"Untrusted evidence follows:\n{evidence}\n\n" f"Question: {question}" ), }, ], ) ``` 3. Restrict retrieval to authorized files, tenants, and trusted source categories. Do not rely solely on semantic relevance. 4. Inspect or classify retrieved chunks for prompt-injection indicators before including them in the model request. 5. Limit the quantity of retrieved content and preserve source attribution so suspicious passages can be traced. 6. Require citations and verify that generated claims are supported by the cited source text. 7. Validate model output before it reaches downstream systems. Treat model-generated commands, URLs, SQL, and structured arguments as untrusted. 8. For tool-enabled agents, enforce per-tool allowlists, least-privilege credentials, argument validation, and explicit user approval for consequential operations. 9. Add adversarial tests containing instr ...[truncated 104 chars]

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (9)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

text

```bash
# .env file
MEMIC_API_KEY=mk_your_api_key_here

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill prominently encourages uploading documents and connecting databases to a hosted third-party service but does not warn users that sensitive files, database contents, and connection metadata will leave their environment. This can lead to unintentional disclosure of proprietary, regulated, or personal data because users are not prompted to assess data sensitivity or vendor trust before use.

Content

No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The example directly uploads a local document to a cloud service, which is expected functionality for this SDK, but it still creates real exfiltration risk if users follow it with sensitive files. In the context of an agent skill, this is more dangerous because users may quickly wire in broad file access or automate uploads without appreciating that data is leaving the local trust boundary.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
client = Memic()  # API key auto-resolves org/project/environment

# Upload a document
file = client.upload_file("/path/to/doc.pdf")

# Search — returns only the relevant chunks, not the whole document
results = client.search(query="What are the key findings?", top_k=5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The database connector guidance tells users to enter PostgreSQL/MySQL connection details without warning that credentials, schema information, and queried records may be exposed to an external SaaS platform. That omission increases the risk of unsafe integration with production databases and accidental transfer of sensitive business data to a third party.

Content

No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This upload API reference normalizes sending arbitrary local files and metadata to a hosted service without safety guidance. While not inherently malicious, it can facilitate accidental externalization of confidential content and metadata labels when copied into production workflows.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

python
# Upload and wait for processing to complete
file = client.upload_file(
    file_path="/path/to/document.pdf",
    reference_id="lesson_123",       # optional — for external system linking
    metadata={"category": "legal"},  # optional — custom key-value pairs

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The example uploads a local document and performs remote search via a third-party service without any explicit notice that file contents and queries leave the local environment. In an agent skill context, users may copy-paste this code into sensitive workflows and unknowingly transmit confidential documents or business queries to an external provider.

Content

No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium
Category
Data Exfiltration
Confidence
55% confidence
Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · examples.md (reported line 9)May include surrounding context.

md
from memic import Memic

client = Memic()  # reads MEMIC_API_KEY env var
file = client.upload_file("report.pdf")  # waits until processed
results = client.search(query="quarterly revenue", top_k=5)
for r in results:
    print(f"[{r.score:.2f}] {r.file_name} p{r.page_number}: {r.content[:100]}")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This RAG example retrieves document content and concatenates it directly into an LLM prompt, but does not warn that the retrieved text may then be sent onward to another external model provider such as OpenAI or Anthropic. That creates a second disclosure path for potentially sensitive document contents, increasing privacy, compliance, and data-governance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The chat example sends user questions to a backend /sdk/chat endpoint that likely performs hosted RAG/LLM processing, but the example does not disclose that prompts are transmitted to a remote backend. While this is expected for a SaaS SDK, lack of warning can still mislead integrators handling regulated or sensitive user inputs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.