Security audit

Claw Recall

Security checks for vulnerabilities and agentic risk

Overview

The skill is a memory search tool, but it documents broad searchable access to private conversations and external sources without enough scoping or remote-access safeguards.

Review carefully before installing. This skill is intended to make private agent transcripts and external sources searchable, including across agents, so only use it with data sources you are comfortable centralizing. Prefer a pinned release or reviewed commit, isolate it in a virtual environment, avoid exposing the SSE endpoint directly, keep keyword-only mode unless external embedding processing is acceptable, and do not index secrets, regulated data, or high-sensitivity accounts without explicit controls.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:41
Finding: Mutable Remote Code Is Retrieved and Executed Without Version Pinning
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:31
Finding: Cross-Agent Search Breaks Least-Privilege Boundaries for Sensitive Records
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:82
Finding: Remote SSE Deployment Uses Plaintext HTTP Without Documented Authentication
Content: View full analysis
Remediation: View remediation

other

Warning

Location: SKILL.md:35
Finding: Local-Only Privacy Claim Conflicts With External OpenAI Embedding Use
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill prominently advertises indexing and unified search across conversation transcripts, Gmail, Google Drive, and Slack, but does not provide a strong, explicit warning about the sensitivity, scope, and privacy implications of ingesting those data sources. This can cause users to enable the skill without appreciating that highly sensitive messages, documents, and cross-agent conversations may become locally searchable and broadly accessible to any connected agent, increasing the risk of unintended disclosure.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.