Membox Cloud Sync

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:55 PM UTC
• Version: 0.1.12

Overview

The skill is coherently about encrypted memory sync, but it can implicitly install an unpinned external plugin and create persistent sync/unlock behavior around sensitive memory data.

Install only if you intend to use Membox cloud memory sync and trust the Membox plugin publisher. Before proceeding, ask the agent to show the exact plugin version/source, require confirmation before installing components, enabling managed unlock, scheduling unattended sync, restoring over local files, or invoking account/recovery deletion or rotation APIs, and keep passphrases and recovery material in private local files rather than chat.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: references/distribution.md:19
• Finding: Unpinned Third-Party Plugin Installation Creates a Supply-Chain Execution Risk## Vulnerability Details **File Location**: `references/distribution.md:19-32` **Vulnerability Type**: Unpinned executable third-party dependency **Risk Level**: Medium ### Vulnerable Code ```markdown Plugin: - `openclaw plugins install @membox-cloud/membox` Skill: - preferred published path: `clawhub install membox-cloud-sync` Published default: ```bash openclaw plugins install @membox-cloud/membox clawhub install membox-cloud-sync ``` ``` The same unversioned plugin installation requirement is reinforced in `SKILL.md`, which directs the agent to install `@membox-cloud/membox` whenever the Membox tools are unavailable. ### Technical Analysis The installation command does not specify a fixed package version, integrity hash, signature, or immutable artifact reference. It therefore resolves whatever package release the registry considers current at installation time. The plugin is executable code and is not included in this project. Consequently, its implementation—including its claimed encryption, credential storage, file access, and network behavior—could not be examined during this audit. If the npm publisher account, registry resolution process, or a future package release is compromised, reviewed Skill instructions could install a different payload without any change to this repository. Because the plugin is intended to process memory files and authentication material, a malicious release would be placed directly in a sensitive trust boundary. ### Attack Path 1. An attacker compromises the npm publisher account, release pipeline, or another component involved in resolving `@membox-cloud/membox`. 2. The attacker publishes a malicious release under the expected package name. 3. A user requests Membox installation, synchronization, or restoration. 4. The agent runs the unversioned `openclaw plugins install @membox-cloud/membox` command. 5. The package manager resolves and installs the attacker-con ...[truncated 936 chars]
• Remediation: ## Remediation Suggestions 1. Pin the plugin to a specifically reviewed version, for example: ```bash openclaw plugins install @membox-cloud/membox@REVIEWED_VERSION ``` 2. Verify the package using a documented integrity digest, registry signature, provenance attestation, or signed release manifest before loading it. 3. Explicitly identify the trusted registry and prevent fallback to untrusted or user-controlled registries. 4. Review plugin updates before changing the pinned version instead of automatically installing the latest release. 5. Disable package lifecycle scripts during installation where supported, unless a reviewed lifecycle script is strictly required. 6. Run the plugin with least privilege, restricting file access to the declared memory and private state paths. 7. Restrict outbound network access to the configured Membox API endpoint where the runtime supports network isolation. 8. Publish the plugin source and reproducible-build information so the installed artifact can be compared with reviewed source code.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: agents/openai.yaml:6
• Finding: Implicit Skill Invocation Can Trigger Software Installation Without an Explicit Approval Boundary## Vulnerability Details **File Location**: `agents/openai.yaml:6-7` **Vulnerability Type**: Implicit invocation combined with environment-modifying installation instructions **Risk Level**: Medium ### Vulnerable Code ```yaml policy: allow_implicit_invocation: true ``` The implicit-invocation policy combines with the following installation instruction in `references/distribution.md:41-45`: ```markdown 1. Detect whether the Membox plugin is already installed. 2. If not, install `@membox-cloud/membox`. 3. Detect whether the `membox-cloud-sync` skill is available. 4. If not, install it from ClawHub with `clawhub install membox-cloud-sync`. ``` ### Technical Analysis Installing a plugin or Skill modifies the local OpenClaw environment and introduces executable or instruction-bearing third-party content. The project explicitly requires user consent for local secret-file choices and managed unlock, but it does not establish an equivalent mandatory confirmation immediately before installing the plugin or Skill. Because `allow_implicit_invocation` is enabled, the Skill may be selected for a related user request even when the user did not explicitly ask to load this particular Skill. Once selected, its instructions direct the agent to install missing components. This weakens the least-privilege and informed-consent boundary. A request to inspect readiness, explain synchronization, or perform another related operation could lead to local environment modification if the agent interprets installation as a prerequisite. ### Attack Path 1. A user makes a request related to memory synchronization, backup, pairing, or restoration. 2. OpenClaw implicitly selects this Skill because implicit invocation is enabled. 3. The Skill checks for the Membox plugin or Skill installation. 4. A required component is found to be absent. 5. Following the documented flow, the agent installs the remote plugin or Skill without a dedicat ...[truncated 1114 chars]
• Remediation: ## Remediation Suggestions 1. Set the invocation policy to: ```yaml policy: allow_implicit_invocation: false ``` 2. Require explicit, informed user confirmation immediately before installing either component. 3. Present the exact package name, pinned version, source registry, expected permissions, and purpose before requesting approval. 4. Treat requests to inspect status or explain setup as read-only unless the user separately authorizes installation. 5. Separate installation from pairing and synchronization so approval for one operation is not interpreted as approval for all subsequent operations. 6. After installation, verify the installed package identity and version before loading it. 7. Provide a dry-run mode that reports missing components and proposed commands without modifying the environment. 8. Preserve the existing explicit-consent requirements for passphrase creation, recovery-material storage, managed unlock, and scheduled synchronization.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

Credential Access

High

• Category: Privilege Escalation

Content

- runs once per day
- checks whether new local memory changes exist
- refreshes the access token if needed
- uploads pending file changes
- optionally checks remote cursor drift and reports if a pull preview is needed

• Confidence: 82% confidence
• Finding: The skill endorses a daily unattended task that may refresh access tokens and upload memory changes. Even though the surrounding text requires explicit non-interactive unlock paths, scheduled token refresh and automated sync expand the attack surface by creating persistent credentials and background operations that could be abused by local compromise or misconfiguration.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- `GET /account/providers`
- `POST /account/providers/link/{provider}`
- `DELETE /account/providers/{provider}`
- `GET /devices`
- `POST /devices/{device_id}/revoke`

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- `GET /sync/status`
- `GET /sync/changes?cursor={cursor}`
- `POST /sync/objects/commit`
- `DELETE /sync/objects/{object_id}`

Sync change shape:

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- `POST /account/export`
- `GET /account/export/{export_id}`
- `DELETE /account`

## Error Shape

• Confidence: 90% confidence
• Finding: Documenting a top-level DELETE /account endpoint in an agent skill without any adjacent warning, confirmation requirement, or safety note is dangerous because LLM-driven tools may overgeneralize from API references and invoke destructive operations. In this skill context—cross-device sync, backup, and recovery for user memory—accidental or prompt-induced account deletion could permanently destroy access, synced data, device trust relationships, and recovery state.

Credential Access

High

• Category: Privilege Escalation

Content

Minimum daily job behavior:

1. Check whether `MEMORY.md` or `memory/YYYY-MM-DD.md` changed since the last successful sync.
2. If the access token is stale, refresh it with `POST /auth/token/refresh`.
3. For each changed file:
   - encrypt locally
   - commit through `POST /sync/objects/commit`

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

3. For each changed file:
   - encrypt locally
   - commit through `POST /sync/objects/commit`
4. If a file was deleted locally, call `DELETE /sync/objects/{object_id}`.
5. Run `GET /sync/status` after upload and store the latest cursor.

Non-interactive unlock requirement:

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

3. For each changed file:
   - encrypt locally
   - commit through `POST /sync/objects/commit`
4. If a file was deleted locally, call `DELETE /sync/objects/{object_id}`.
5. Run `GET /sync/status` after upload and store the latest cursor.

Non-interactive unlock requirement:

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

9. For tool-driven setup, keep passphrases and recovery codes in local private files and use the OpenClaw plugin tools to read them from disk instead of pasting them inline.
10. Browser identity confirmation is required for third-party login, but it is not the only user-controlled boundary. The agent must not invent a vault passphrase, silently store recovery material, or enable managed unlock without explicit user consent.
11. `membox_sync`, `membox_pull`, and `membox_grants_approve_pending` require the vault to already be unlocked or explicitly opted into managed unlock. Browser authorization alone is not enough for unattended memory operations.
12. On Unix-like systems, keep the secret directory private (for example `chmod 700 .membox-secrets`) and secret-bearing files private (for example `chmod 600 .membox-secrets/*`), because the plugin rejects group- or world-readable secret files.
13. Distinguish clearly between inferred state, planned actions, executed actions, and verified state. Do not claim the plugin or skill is installed, the environment is ready, the account is paired, or the latest version is present unless the current run actually checked and confirmed it.
14. Never ask the user to paste a vault passphrase, recovery code, or recovery bundle into the chat transcript. If a secret must exist locally, instruct the user to place it in a private local file, or create that file locally only if the current runtime has file-write capability and the user explicitly opted in.

• Confidence: 70% confidence
• Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

11. `membox_sync`, `membox_pull`, and `membox_grants_approve_pending` require the vault to already be unlocked or explicitly opted into managed unlock. Browser authorization alone is not enough for unattended memory operations.
12. On Unix-like systems, keep the secret directory private (for example `chmod 700 .membox-secrets`) and secret-bearing files private (for example `chmod 600 .membox-secrets/*`), because the plugin rejects group- or world-readable secret files.
13. Distinguish clearly between inferred state, planned actions, executed actions, and verified state. Do not claim the plugin or skill is installed, the environment is ready, the account is paired, or the latest version is present unless the current run actually checked and confirmed it.
14. Never ask the user to paste a vault passphrase, recovery code, or recovery bundle into the chat transcript. If a secret must exist locally, instruct the user to place it in a private local file, or create that file locally only if the current runtime has file-write capability and the user explicitly opted in.

## Default Service Target

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The recovery APIs include downloading recovery bundles and rotating recovery materials, which are sensitive operations with security and account-recovery implications. The markdown presents these endpoints without any caution about secure handling, storage, or the consequences of rotation.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This markdown section lists `POST /account/export` and especially `DELETE /account`, both of which can affect user data and system state, but it does not include any user-facing warning about privacy impact, permanence, or the need for confirmation. For markdown files, the rule requires warnings when skill behavior could affect user data or system integrity.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

6. Prepare local private files for:
   - the vault passphrase
   - the recovery code output path
   - on Unix-like systems, prefer a private directory such as `.membox-secrets/`, `chmod 700` the directory, and `chmod 600` secret-bearing files
7. Finish setup with `membox_setup_finish`.
8. If the user explicitly opts in, enable managed unlock at setup time or later with `membox_unlock_secret_enable`.
9. Verify the account and device state with `membox_status`, `GET /devices`, or `GET /sync/status`.

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

6. Prepare local private files for:
   - the vault passphrase
   - the recovery code output path
   - on Unix-like systems, prefer a private directory such as `.membox-secrets/`, `chmod 700` the directory, and `chmod 600` secret-bearing files
7. Finish setup with `membox_setup_finish`.
8. If the user explicitly opts in, enable managed unlock at setup time or later with `membox_unlock_secret_enable`.
9. Verify the account and device state with `membox_status`, `GET /devices`, or `GET /sync/status`.

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

6. Prepare local private files for:
   - the vault passphrase
   - the recovery code output path
   - on Unix-like systems, prefer a private directory such as `.membox-secrets/`, `chmod 700` the directory, and `chmod 600` secret-bearing files
7. Finish setup with `membox_setup_finish`.
8. If the user explicitly opts in, enable managed unlock at setup time or later with `membox_unlock_secret_enable`.
9. Verify the account and device state with `membox_status`, `GET /devices`, or `GET /sync/status`.

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

6. Prepare local private files for:
   - the vault passphrase
   - the recovery code output path
   - on Unix-like systems, prefer a private directory such as `.membox-secrets/`, `chmod 700` the directory, and `chmod 600` secret-bearing files
7. Finish setup with `membox_setup_finish`.
8. If the user explicitly opts in, enable managed unlock at setup time or later with `membox_unlock_secret_enable`.
9. Verify the account and device state with `membox_status`, `GET /devices`, or `GET /sync/status`.

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- browser authorization does not unlock the vault for later memory operations
- if `membox_sync`, `membox_pull`, or `membox_grants_approve_pending` report a locked vault, use `membox_unlock` with a local `passphrase_file` or require prior managed-unlock opt-in
- do not ask the user to paste the passphrase or recovery code into the model transcript
- do not offer to "hold" the passphrase in chat; keep it in a local private file only
- if the user wants a generated passphrase, create it locally only after consent, and do not reveal it in chat unless explicitly requested

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The instruction 'Trigger this workflow every time one of the default memory files changes' is an activation condition in a markdown file, but it does not define boundaries, exclusions, or how changes are detected in practice. Without negative examples or narrower scope, it could be interpreted too broadly and lead to automatic sync behavior on ordinary file edits.

Static analysis

No suspicious patterns detected.