Security audit

MemoryBox

Security checks for vulnerabilities and agentic risk

Overview

The skill describes a useful memory-maintenance tool, but its default install path fetches unaudited code from GitHub and exposes it as a system-wide command with sudo.

Review the GitHub repository and install from a pinned commit or signed release before use. Prefer a user-local path such as ~/.local/bin instead of /usr/local/bin, and only run it against memory directories you are comfortable letting the tool read and modify.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:20
Finding: Unpinned Remote Payload Retrieval and System-Wide Command Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The documented command uses sudo to modify a privileged executable path, which conditions users to elevate privileges during installation of code fetched directly from GitHub. Even though the specific command only creates a symlink, it makes untrusted repository content easily invokable system-wide and could facilitate abuse if the script is later modified or replaced.
Content: Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
bash
git clone https://github.com/Ramsbaby/openclaw-memorybox.git cd openclaw-memorybox && chmod +x bin/memorybox sudo ln -sf "$(pwd)/bin/memorybox" /usr/local/bin/memorybox

Usage

Missing User Warnings