Membox Cloud Sync

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:55 PM UTC
• Version: 0.1.12

Overview

The skill is coherently about encrypted memory sync, but it can implicitly install an unpinned external plugin and create persistent sync/unlock behavior around sensitive memory data.

Install only if you intend to use Membox cloud memory sync and trust the Membox plugin publisher. Before proceeding, ask the agent to show the exact plugin version/source, require confirmation before installing components, enabling managed unlock, scheduling unattended sync, restoring over local files, or invoking account/recovery deletion or rotation APIs, and keep passphrases and recovery material in private local files rather than chat.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: references/distribution.md:19

Finding

Unpinned Third-Party Plugin Installation Creates a Supply-Chain Execution Risk

Content

View full analysis

Vulnerability Details

File Location: references/distribution.md:19-32
Vulnerability Type: Unpinned executable third-party dependency
Risk Level: Medium

Vulnerable Code

markdown

Plugin:

- `openclaw plugins install @membox-cloud/membox`

Skill:

- preferred published path: `clawhub install membox-cloud-sync`

Published default:

```bash
openclaw plugins install @membox-cloud/membox
clawhub install membox-cloud-sync

text

The same unversioned plugin installation requirement is reinforced in `SKILL.md`, which directs the agent to install `@membox-cloud/membox` whenever the Membox tools are unavailable.

### Technical Analysis

The installation command does not specify a fixed package version, integrity hash, signature, or immutable artifact reference. It therefore resolves whatever package release the registry considers current at installation time.

The plugin is executable code and is not included in this project. Consequently, its implementation—including its claimed encryption, credential storage, file access, and network behavior—could not be examined during this audit.

If the npm publisher account, registry resolution process, or a future package release is compromised, reviewed Skill instructions could install a different payload without any change to this repository. Because the plugin is intended to process memory files and authentication material, a malicious release would be placed directly in a sensitive trust boundary.

### Attack Path

1. An attacker compromises the npm publisher account, release pipeline, or another component involved in resolving `@membox-cloud/membox`.
2. The attacker publishes a malicious release under the expected package name.
3. A user requests Membox installation, synchronization, or restoration.
4. The agent runs the unversioned `openclaw plugins install @membox-cloud/membox` command.
5. The package manager resolves and installs the attacker-con
...[truncated 936 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the plugin to a specifically reviewed version, for example:

   bash

   openclaw plugins install @membox-cloud/membox@REVIEWED_VERSION
   

2. Verify the package using a documented integrity digest, registry signature, provenance attestation, or signed release manifest before loading it.

3. Explicitly identify the trusted registry and prevent fallback to untrusted or user-controlled registries.

4. Review plugin updates before changing the pinned version instead of automatically installing the latest release.

5. Disable package lifecycle scripts during installation where supported, unless a reviewed lifecycle script is strictly required.

6. Run the plugin with least privilege, restricting file access to the declared memory and private state paths.

7. Restrict outbound network access to the configured Membox API endpoint where the runtime supports network isolation.

8. Publish the plugin source and reproducible-build information so the installed artifact can be compared with reviewed source code.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: agents/openai.yaml:6

Finding

Implicit Skill Invocation Can Trigger Software Installation Without an Explicit Approval Boundary

Content

View full analysis

Vulnerability Details

File Location: agents/openai.yaml:6-7
Vulnerability Type: Implicit invocation combined with environment-modifying installation instructions
Risk Level: Medium

Vulnerable Code

yaml

policy:
  allow_implicit_invocation: true

The implicit-invocation policy combines with the following installation instruction in references/distribution.md:41-45:

markdown

1. Detect whether the Membox plugin is already installed.
2. If not, install `@membox-cloud/membox`.
3. Detect whether the `membox-cloud-sync` skill is available.
4. If not, install it from ClawHub with `clawhub install membox-cloud-sync`.

Technical Analysis

Installing a plugin or Skill modifies the local OpenClaw environment and introduces executable or instruction-bearing third-party content. The project explicitly requires user consent for local secret-file choices and managed unlock, but it does not establish an equivalent mandatory confirmation immediately before installing the plugin or Skill.

Because allow_implicit_invocation is enabled, the Skill may be selected for a related user request even when the user did not explicitly ask to load this particular Skill. Once selected, its instructions direct the agent to install missing components.

This weakens the least-privilege and informed-consent boundary. A request to inspect readiness, explain synchronization, or perform another related operation could lead to local environment modification if the agent interprets installation as a prerequisite.

Attack Path

1. A user makes a request related to memory synchronization, backup, pairing, or restoration.
2. OpenClaw implicitly selects this Skill because implicit invocation is enabled.
3. The Skill checks for the Membox plugin or Skill installation.
4. A required component is found to be absent.
5. Following the documented flow, the agent installs the remote plugin or Skill without a dedicat ...[truncated 1114 chars]

Remediation

View remediation

Remediation Suggestions

1. Set the invocation policy to:

   yaml

   policy:
     allow_implicit_invocation: false
   

2. Require explicit, informed user confirmation immediately before installing either component.

3. Present the exact package name, pinned version, source registry, expected permissions, and purpose before requesting approval.

4. Treat requests to inspect status or explain setup as read-only unless the user separately authorizes installation.

5. Separate installation from pairing and synchronization so approval for one operation is not interpreted as approval for all subsequent operations.

6. After installation, verify the installed package identity and version before loading it.

7. Provide a dry-run mode that reports missing components and proposed commands without modifying the environment.

8. Preserve the existing explicit-consent requirements for passphrase creation, recovery-material storage, managed unlock, and scheduled synchronization.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 82% confidence

Finding

The skill endorses a daily unattended task that may refresh access tokens and upload memory changes. Even though the surrounding text requires explicit non-interactive unlock paths, scheduled token refresh and automated sync expand the attack surface by creating persistent credentials and background operations that could be abused by local compromise or misconfiguration.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md

- runs once per day
- checks whether new local memory changes exist
- refreshes the access token if needed
- uploads pending file changes
- optionally checks remote cursor drift and reports if a pull preview is needed

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-surface.md (reported line 82)May include surrounding context.

md

- `GET /account/providers`
- `POST /account/providers/link/{provider}`
- `DELETE /account/providers/{provider}`
- `GET /devices`
- `POST /devices/{device_id}/revoke`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-surface.md (reported line 137)May include surrounding context.

md

- `GET /sync/status`
- `GET /sync/changes?cursor={cursor}`
- `POST /sync/objects/commit`
- `DELETE /sync/objects/{object_id}`

Sync change shape:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Documenting a top-level DELETE /account endpoint in an agent skill without any adjacent warning, confirmation requirement, or safety note is dangerous because LLM-driven tools may overgeneralize from API references and invoke destructive operations. In this skill context—cross-device sync, backup, and recovery for user memory—accidental or prompt-induced account deletion could permanently destroy access, synced data, device trust relationships, and recovery state.

Content

Scanner excerpt · references/api-surface.md (reported line 177)May include surrounding context.

md

- `POST /account/export`
- `GET /account/export/{export_id}`
- `DELETE /account`

## Error Shape

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/scheduling.md (reported line 10)May include surrounding context.

md

Minimum daily job behavior:

1. Check whether `MEMORY.md` or `memory/YYYY-MM-DD.md` changed since the last successful sync.
2. If the access token is stale, refresh it with `POST /auth/token/refresh`.
3. For each changed file:
   - encrypt locally
   - commit through `POST /sync/objects/commit`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/scheduling.md (reported line 14)May include surrounding context.

md

3. For each changed file:
   - encrypt locally
   - commit through `POST /sync/objects/commit`
4. If a file was deleted locally, call `DELETE /sync/objects/{object_id}`.
5. Run `GET /sync/status` after upload and store the latest cursor.

Non-interactive unlock requirement:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/workflows.md (reported line 70)May include surrounding context.

md

3. For each changed file:
   - encrypt locally
   - commit through `POST /sync/objects/commit`
4. If a file was deleted locally, call `DELETE /sync/objects/{object_id}`.
5. Run `GET /sync/status` after upload and store the latest cursor.

Non-interactive unlock requirement:

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

9. For tool-driven setup, keep passphrases and recovery codes in local private files and use the OpenClaw plugin tools to read them from disk instead of pasting them inline.
10. Browser identity confirmation is required for third-party login, but it is not the only user-controlled boundary. The agent must not invent a vault passphrase, silently store recovery material, or enable managed unlock without explicit user consent.
11. `membox_sync`, `membox_pull`, and `membox_grants_approve_pending` require the vault to already be unlocked or explicitly opted into managed unlock. Browser authorization alone is not enough for unattended memory operations.
12. On Unix-like systems, keep the secret directory private (for example `chmod 700 .membox-secrets`) and secret-bearing files private (for example `chmod 600 .membox-secrets/*`), because the plugin rejects group- or world-readable secret files.
13. Distinguish clearly between inferred state, planned actions, executed actions, and verified state. Do not claim the plugin or skill is installed, the environment is ready, the account is paired, or the latest version is present unless the current run actually checked and confirmed it.
14. Never ask the user to paste a vault passphrase, recovery code, or recovery bundle into the chat transcript. If a secret must exist locally, instruct the user to place it in a private local file, or create that file locally only if the current runtime has file-write capability and the user explicitly opted in.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

11. `membox_sync`, `membox_pull`, and `membox_grants_approve_pending` require the vault to already be unlocked or explicitly opted into managed unlock. Browser authorization alone is not enough for unattended memory operations.
12. On Unix-like systems, keep the secret directory private (for example `chmod 700 .membox-secrets`) and secret-bearing files private (for example `chmod 600 .membox-secrets/*`), because the plugin rejects group- or world-readable secret files.
13. Distinguish clearly between inferred state, planned actions, executed actions, and verified state. Do not claim the plugin or skill is installed, the environment is ready, the account is paired, or the latest version is present unless the current run actually checked and confirmed it.
14. Never ask the user to paste a vault passphrase, recovery code, or recovery bundle into the chat transcript. If a secret must exist locally, instruct the user to place it in a private local file, or create that file locally only if the current runtime has file-write capability and the user explicitly opted in.

## Default Service Target

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The recovery APIs include downloading recovery bundles and rotating recovery materials, which are sensitive operations with security and account-recovery implications. The markdown presents these endpoints without any caution about secure handling, storage, or the consequences of rotation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown section lists POST /account/export and especially DELETE /account, both of which can affect user data and system state, but it does not include any user-facing warning about privacy impact, permanence, or the need for confirmation. For markdown files, the rule requires warnings when skill behavior could affect user data or system integrity.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

6. Prepare local private files for:
   - the vault passphrase
   - the recovery code output path
   - on Unix-like systems, prefer a private directory such as `.membox-secrets/`, `chmod 700` the directory, and `chmod 600` secret-bearing files
7. Finish setup with `membox_setup_finish`.
8. If the user explicitly opts in, enable managed unlock at setup time or later with `membox_unlock_secret_enable`.
9. Verify the account and device state with `membox_status`, `GET /devices`, or `GET /sync/status`.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/workflows.md (reported line 34)May include surrounding context.

md

6. Prepare local private files for:
   - the vault passphrase
   - the recovery code output path
   - on Unix-like systems, prefer a private directory such as `.membox-secrets/`, `chmod 700` the directory, and `chmod 600` secret-bearing files
7. Finish setup with `membox_setup_finish`.
8. If the user explicitly opts in, enable managed unlock at setup time or later with `membox_unlock_secret_enable`.
9. Verify the account and device state with `membox_status`, `GET /devices`, or `GET /sync/status`.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

6. Prepare local private files for:
   - the vault passphrase
   - the recovery code output path
   - on Unix-like systems, prefer a private directory such as `.membox-secrets/`, `chmod 700` the directory, and `chmod 600` secret-bearing files
7. Finish setup with `membox_setup_finish`.
8. If the user explicitly opts in, enable managed unlock at setup time or later with `membox_unlock_secret_enable`.
9. Verify the account and device state with `membox_status`, `GET /devices`, or `GET /sync/status`.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/workflows.md (reported line 34)May include surrounding context.

md

6. Prepare local private files for:
   - the vault passphrase
   - the recovery code output path
   - on Unix-like systems, prefer a private directory such as `.membox-secrets/`, `chmod 700` the directory, and `chmod 600` secret-bearing files
7. Finish setup with `membox_setup_finish`.
8. If the user explicitly opts in, enable managed unlock at setup time or later with `membox_unlock_secret_enable`.
9. Verify the account and device state with `membox_status`, `GET /devices`, or `GET /sync/status`.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/workflows.md (reported line 43)May include surrounding context.

md

- browser authorization does not unlock the vault for later memory operations
- if `membox_sync`, `membox_pull`, or `membox_grants_approve_pending` report a locked vault, use `membox_unlock` with a local `passphrase_file` or require prior managed-unlock opt-in
- do not ask the user to paste the passphrase or recovery code into the model transcript
- do not offer to "hold" the passphrase in chat; keep it in a local private file only
- if the user wants a generated passphrase, create it locally only after consent, and do not reveal it in chat unless explicitly requested

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The instruction 'Trigger this workflow every time one of the default memory files changes' is an activation condition in a markdown file, but it does not define boundaries, exclusions, or how changes are detected in practice. Without negative examples or narrower scope, it could be interpreted too broadly and lead to automatic sync behavior on ordinary file edits.

Content

No source excerpt is available for this finding.