Security audit

Claw Store Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent remote memory tool, but it handles the long-term encryption key in ways that could expose saved memories.

Install only if you are comfortable with this skill storing AI memory remotely and managing a long-term local encryption key. Before use, create the key file with owner-only permissions, avoid running keygen or first-run setup where output is logged, and consider installing dependencies in an isolated environment with pinned versions.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: jackal-memory/client.py:42
Finding: Encryption Key Stored Without Explicitly Restrictive File Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: jackal-memory/client.py:47
Finding: Encryption Key Disclosed Through Standard Output and Error Streams
Content: View full analysis
None: key = _encryption_key() key_hex = key.hex() print(f"\nActive encryption key:\n\n {key_hex}\n") print("Set this in your environment to use the same key on other machines:") print(f" export JACKAL_MEMORY_ENCRYPTION_KEY={key_hex}\n") print("Keep this key safe — lose it and your encrypted memories are unrecoverable.") ``` ### Technical Analysis The first-run flow prints the complete encryption key to standard error, and the `keygen` command prints it to standard output. Agent runtimes, CI systems, terminal recorders, support bundles, process supervisors, and shell wrappers commonly capture these streams. This behavior conflicts with the documentation's instruction never to expose `JACKAL_MEMORY_ENCRYPTION_KEY` in output. Redirection to standard error does not protect a secret because standard error is frequently retained in the same logs as standard output. The key protects all memory encrypted by the client. Consequently, disclosure is materially more sensitive than exposing a single memory record. ### Attack Path 1. A user or agent invokes the client for the first time, or invokes `client.py keygen`. 2. The complete AES key is printed to standard error or standard output. 3. The surrounding agent platform, CI runner, shell history capture, logging service, or terminal recording retains the output. 4. A user or service with access to those logs extracts the hexadecimal key. 5. The attacker obtains corresponding encrypted memor ...[truncated 569 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:21
Finding: Unpinned Cryptography Dependency Installation
Content: View full analysis
` 3. Install dependency: `pip install cryptography` 4. On first save, an encryption key is auto-generated and saved to `~/.config/jackal-memory/key`. ``` ### Technical Analysis The setup instructions install `cryptography` without a version constraint, lock file, or artifact hash. Installation therefore resolves whichever release and transitive dependencies are available from the configured package index at execution time. This makes installations non-reproducible and allows the reviewed code to run against dependency versions that were not part of the audit. A future compromised release, compromised package index, unsafe configured mirror, or incompatible update could introduce malicious behavior or break cryptographic processing. No evidence was found that the currently named `cryptography` package is malicious. The risk arises from unconstrained future dependency resolution rather than confirmed package compromise. ### Attack Path 1. A user follows the documented setup command. 2. `pip` queries the user's configured package index or mirror and resolves the latest available package artifacts. 3. The index, mirror, release account, or resolved artifact has been compromised, or an unreviewed incompatible version has been published. 4. The package is installed into the user's Python environment. 5. Package code executes during import when the client performs encryption or decryption. 6. Malicious dependency code can act with the privileges of the user running the Skill, including reading environment variables, local files, API credentials, and encryption keys. ### Impact Assessment A compromised dependency would execute with the sa ...[truncated 415 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill requests and documents capabilities that access environment secrets, local files, and a remote network service, but it does not declare any explicit tool scope or allowed-tools restrictions. That increases the blast radius because an agent runtime may grant broader-than-necessary access, allowing unintended exposure of API keys, encryption keys, or sensitive memory contents through file and network operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The client auto-generates a long-term encryption key and writes it to a predictable location in the user's home directory without setting restrictive file permissions or requiring explicit user consent before persisting secret material. If the file is readable by other local users, included in backups, or harvested by malware, an attacker who also obtains stored ciphertext can decrypt all memories protected by that key.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The docstring explicitly states, "Encryption is always on — there is no opt-out." This imposes a fixed behavior without offering user choice or documenting a justified policy need, which matches the natural-language policy concern around forced settings without opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.