Real Memory Continuity

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:52 AM UTC
• Version: 1.0.0

Overview

This is a local memory/continuity scaffold that stores notes on disk, with no evidence of hidden exfiltration, destructive behavior, or unsafe install actions.

Install only if you want a local continuity/memory scaffold. When used, it can write questions, identity notes, and reflection logs under ~/clawd/memory or CONTINUITY_MEMORY_DIR, so avoid feeding it sensitive transcripts unless you are comfortable with local persistence and manually delete stored files when needed. Enable the heartbeat workflow only if you explicitly want post-session reflection.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The code partially aligns with the theme of continuity and question surfacing: it does persist pending questions, store a simple identity file, write reflection logs, and display surfaced questions in a greeting. However, the main declared functionality is materially overstated relative to the implementation. The core reflective intelligence—analyzing sessions, extracting structured memories with confidence scores, generating follow-up questions, and producing identity updates—is not actually present. The analyze_session function is explicitly a placeholder returning empty structures, and the reflect command either reads a supplied file and does nothing substantive with it or falls back to manual question entry. There is also no heartbeat or automatic trigger integration. So while the code is directionally related, the implemented behavior is significantly less capable than the declared description, making this a mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill describes capabilities that require environment access and file writes, but it does not declare an explicit tool scope or permission boundary. That creates a governance gap where a host may grant broader-than-expected access, especially because the skill persists memory and identity data to local files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is designed to persist conversation-derived memories, relationship information, and identity updates across sessions, but the user-facing description does not clearly warn about that retention. This can lead to users disclosing sensitive personal or relational data without informed consent or awareness of long-term storage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The heartbeat integration proposes automatic post-session reflection after 30 minutes of user idle time, but it does not clearly warn that analysis may run automatically without a fresh prompt. Automatic processing of conversation history after disengagement increases privacy risk and can surprise users who reasonably expect analysis to happen only during active interaction.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring describes a system that transforms passive logging into active AI development through post-session reflection, structured memory extraction, question generation, and identity evolution. However, the core analyzer docstring and implementation state that in production it would use an LLM and currently just returns a template structure, so the documentation overstates what the code actually does.

Content

No source excerpt is available for this finding.

Tainted flow: 'QUESTIONS_FILE' from os.environ.get (line 22, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/continuity.py (reported line 79)May include surrounding context.

python

"""Save questions to file."""
    ensure_dirs()
    
    with open(QUESTIONS_FILE, 'w') as f:
        f.write("# Pending Questions\n\n")
        f.write(f"_Generated from reflection. Last updated: {datetime.now(timezone.utc).isoformat()}_\n\n")

Tainted flow: 'IDENTITY_FILE' from os.environ.get (line 23, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/continuity.py (reported line 123)May include surrounding context.

python

"""Save identity/self-model."""
    ensure_dirs()
    
    with open(IDENTITY_FILE, 'w') as f:
        f.write("# Identity\n\n")
        f.write(f"_Last updated: {datetime.now(timezone.utc).isoformat()}_\n\n")

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest describes asynchronous reflection that extracts structured memories with confidence scores, but analyze_session is a stub that always returns empty memories and questions, with no confidence-scored extraction logic. The surrounding reflect command therefore only reads a provided file and writes local question/identity/reflection artifacts rather than performing the claimed memory integration behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill persists reflection output derived from session transcripts into local files without explicit consent, warning, retention controls, or redaction. In a continuity/memory skill, transcripts may contain secrets, personal data, or sensitive conversation history, so silent persistence increases the risk of privacy leakage through local compromise, backups, or unintended sharing.

Content

No source excerpt is available for this finding.

Tainted flow: 'reflection_file' from os.environ.get (line 220, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/continuity.py (reported line 221)May include surrounding context.

python

# Save reflection log
        reflection_file = REFLECTIONS_DIR / f"{datetime.now().strftime('%Y-%m-%d-%H%M')}.json"
        with open(reflection_file, 'w') as f:
            json.dump({
                "timestamp": datetime.now(timezone.utc).isoformat(),
                "analysis": analysis

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 73% confidence

Finding

The example identity update contains normative language about the agent adopting a deeper collaborative role, which can imply a behavioral or relational stance beyond the user's explicit choice. This is a natural-language policy concern because it frames a specific interaction mode without documenting user opt-in or choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.