ClawHub
Back to skill

Security audit

Continuity Framework

Security checks across malware telemetry and agentic risk

Overview

This is a local memory helper that intentionally stores reflection questions and identity notes on disk, with no evidence of hidden network access, credential theft, or destructive behavior.

Install only if you want local cross-session memory. Review the configured CONTINUITY_MEMORY_DIR, avoid using it for sensitive conversations you do not want retained, and enable heartbeat reflection only when background post-session processing is acceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Tainted flow: 'QUESTIONS_FILE' from os.environ.get (line 22, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
"""Save questions to file."""
    ensure_dirs()
    
    with open(QUESTIONS_FILE, 'w') as f:
        f.write("# Pending Questions\n\n")
        f.write(f"_Generated from reflection. Last updated: {datetime.now(timezone.utc).isoformat()}_\n\n")
Confidence
91% confidence
Finding
with open(QUESTIONS_FILE, 'w') as f:

Tainted flow: 'IDENTITY_FILE' from os.environ.get (line 23, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
"""Save identity/self-model."""
    ensure_dirs()
    
    with open(IDENTITY_FILE, 'w') as f:
        f.write("# Identity\n\n")
        f.write(f"_Last updated: {datetime.now(timezone.utc).isoformat()}_\n\n")
Confidence
91% confidence
Finding
with open(IDENTITY_FILE, 'w') as f:

Tainted flow: 'reflection_file' from os.environ.get (line 220, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
# Save reflection log
        reflection_file = REFLECTIONS_DIR / f"{datetime.now().strftime('%Y-%m-%d-%H%M')}.json"
        with open(reflection_file, 'w') as f:
            json.dump({
                "timestamp": datetime.now(timezone.utc).isoformat(),
                "analysis": analysis
Confidence
89% confidence
Finding
with open(reflection_file, 'w') as f:

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill documentation instructs use of environment variables and persistent file writes but does not declare permissions. That creates a transparency and control gap: operators may enable the skill without realizing it can persist conversation-derived data or consume environment-based configuration, increasing the risk of unauthorized retention or misuse of sensitive context.

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding
The documented purpose presents a bounded reflection/memory feature, but the described behavior extends into maintaining an identity/self-model, status/reporting over stored data, manual capture flows, question lifecycle management, and reflection log writing. This mismatch is dangerous because reviewers and users may underestimate the scope of data collection, persistence, and behavioral influence, especially where the skill updates long-lived identity artifacts from conversation data.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill advertises post-session reflection and memory integration without a clear warning that conversation content may be analyzed after the session and written to persistent storage. This creates a privacy and consent risk, because users may disclose sensitive information without understanding that it will be retained, reprocessed later, and surfaced in future sessions.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The tool persists reflection analysis, memories, and identity information from sessions to local storage without any consent gate, warning, retention control, or data-minimization safeguard. In a continuity/memory skill, this increases privacy risk because users may not realize their conversation-derived data is being stored and resurfaced across sessions.

Ssd 3

Medium
Confidence
87% confidence
Finding
This code path is intentionally designed to retain questions extracted from prior conversations for use in later sessions. Although that is the feature's purpose, it creates a real cross-session data persistence channel that can expose sensitive user information, especially if prompts or transcripts contain personal, confidential, or regulated data.

Ssd 3

Medium
Confidence
90% confidence
Finding
The greeting flow deliberately replays prior-session-derived questions and identity narrative into future sessions. In context, this makes the skill more dangerous, not less, because resurfacing stored content can reveal private information to the wrong user, in the wrong context, or after account/session confusion.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.