ClawHub
Back to skill

Security audit

MemoryBox

Security checks for vulnerabilities and agentic risk

Overview

The skill describes a useful memory-maintenance tool, but its default install path fetches unaudited code from GitHub and exposes it as a system-wide command with sudo.

Review the GitHub repository and install from a pinned commit or signed release before use. Prefer a user-local path such as ~/.local/bin instead of /usr/local/bin, and only run it against memory directories you are comfortable letting the tool read and modify.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:20
Finding
Unpinned Remote Payload Retrieval and System-Wide Command Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 20-22 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash git clone https://github.com/Ramsbaby/openclaw-memorybox.git cd openclaw-memorybox && chmod +x bin/memorybox sudo ln -sf "$(pwd)/bin/memorybox" /usr/local/bin/memorybox ``` ### Technical Analysis The installation procedure clones a mutable default branch from an external GitHub repository without pinning a reviewed commit or verifying a cryptographic checksum. It then marks the remotely obtained `bin/memorybox` file as executable and creates a system-wide command link in `/usr/local/bin`. The executable implementation is not included in the audited artifact, which contains only `SKILL.md`. Consequently, the claim that the tool only modifies file structure cannot be verified. The effective payload may also change after this Skill has been reviewed if the upstream repository is updated or compromised. Although `sudo` applies directly to the symlink operation rather than execution of the downloaded program, the command forcibly replaces the destination using `ln -sf`. Subsequent `memorybox` invocations execute the externally controlled file with the invoking user's privileges and access, including access to the user's OpenClaw memory files. ### Attack Path 1. An attacker compromises the upstream repository, its maintainer account, or the repository's distribution process. 2. The attacker modifies `bin/memorybox` on the mutable branch cloned by the documented installation command. 3. A user follows the instructions and retrieves the altered repository without commit pinning or integrity verification. 4. The downloaded file is marked executable. 5. A privileged, system-wide command link is created at `/usr/local/bin/memorybox`, potentially replacing an existing destination. 6. When the user invokes one of the documented `memorybox` commands, the altered payload executes wi ...[truncated 861 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin installation to a specific reviewed commit or immutable signed release rather than cloning the mutable default branch. 2. Publish and verify a SHA-256 checksum or cryptographic signature before granting execute permission. 3. Include the executable in the audited Skill package when practical so its behavior can be reviewed together with the documentation. 4. Install into a user-owned directory such as `~/.local/bin` instead of using `sudo` and `/usr/local/bin`. 5. Avoid `ln -sf`; detect an existing destination and abort unless the user explicitly approves its replacement. 6. Document the exact files and directories the executable may access or modify. 7. Apply least privilege at runtime and validate target paths before permitting memory-management operations. 8. Re-audit the external implementation and its update mechanism before treating its file-access and privacy claims as verified. ]]>

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```bash
git clone https://github.com/Ramsbaby/openclaw-memorybox.git
cd openclaw-memorybox && chmod +x bin/memorybox
sudo ln -sf "$(pwd)/bin/memorybox" /usr/local/bin/memorybox
```

## Usage
Confidence
95% confidence
Finding
The documented command uses sudo to modify a privileged executable path, which conditions users to elevate privileges during installation of code fetched directly from GitHub. Even though the specific command only creates a symlink, it makes untrusted repository content easily invokable system-wide and could facilitate abuse if the script is later modified or replaced.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The installation instructions tell users to create a system-wide symlink in /usr/local/bin using sudo, but provide no warning about the trust implications of cloning and exposing an unreviewed script as an executable command for all users. While not inherently malicious, this encourages privileged system modification from a third-party repository and increases the risk of persistence or accidental execution of altered code.

Static analysis

No suspicious patterns detected.