Clawhub

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:23 AM UTC
• Version: 0.3.2

Overview

This is a disclosed memory-governance skill that can affect persistent agent memory when deliberately integrated, but I found no hidden execution, exfiltration, or automatic host modification.

Install this only if you want a shared policy for what the agent may remember and where memory-like state should be routed. Treat any integration with AGENTS.md, other skills, or long-term memory files as a deliberate review step, keep secrets out of memory, and use the checker to validate host wiring before relying on it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (39)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared description presents the skill as a memory governance kernel that enforces or complements AI memory-management behavior. The supplied code does not implement governance logic, correction staging, routing, privacy enforcement, or hardening rules. Instead, it performs host setup/scaffolding: creating directories and copying example files into a specified root. While these files may relate to the broader memory-governor project, this code chunk’s actual primary function is installation/bootstrap of example assets, which is a materially different purpose from the declared behavioral description.

Ae1

High

• Category: analysis-evasion

Content

1. `SKILL.md`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill references host-readable configuration and memory files via metadata configPaths and explicitly directs readers to open multiple local files under the repository, which implies filesystem read behavior without declaring any tool scope or allowed-tools boundary. In an agent environment, undeclared file-read capability weakens least-privilege controls and can lead to overbroad access to sensitive local memory/config content if the host infers or permits reads implicitly.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This markdown file presents its explanatory instructions entirely in Chinese, including operational guidance about which file humans versus tools should read. The policy requires avoiding forced language or locale constraints unless the skill offers user choice or clearly documents a justified region-specific limitation, which is not present here.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The README content is entirely written in Chinese and does not provide any indication that language choice is optional or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy rule for natural-language violations, this can be a locale/language constraint imposed without user opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The only instructional text in the file is written in Chinese, with no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking context. This creates a natural-language locale policy concern because it implicitly mandates a specific language without user opt-in.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

[integration]
host_entry_paths = ["HOST.md"]
writer_contract_paths = ["skills/example-writer/SKILL.md"]

[authorization]
allowed_capabilities = ["writer"]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

[integration]
host_entry_paths = ["HOST.md"]
writer_contract_paths = ["skills/example-writer/SKILL.md"]

[authorization]
allowed_capabilities = ["writer"]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

[integration]
host_entry_paths = ["HOST.md"]
writer_contract_paths = ["skills/example-writer/SKILL.md"]

[authorization]
allowed_capabilities = ["writer"]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

[integration]
host_entry_paths = ["HOST.md"]
writer_contract_paths = ["skills/example-writer/SKILL.md"]

[authorization]
allowed_capabilities = ["writer"]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

[integration]
host_entry_paths = ["HOST.md"]
writer_contract_paths = ["skills/example-writer/SKILL.md"]

[authorization]
allowed_capabilities = ["writer"]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

[integration]
host_entry_paths = ["HOST.md"]
writer_contract_paths = ["skills/example-writer/SKILL.md"]

[authorization]
allowed_capabilities = ["writer"]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

[integration]
host_entry_paths = ["HOST.md"]
writer_contract_paths = ["skills/example-writer/SKILL.md"]

[authorization]
allowed_capabilities = ["writer"]

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Persistent Context Injection

Medium

• Category: Memory Poisoning

Content

### Candidate: route explicit corrections here before hardening

- summary: capture explicit corrections before they become reusable lessons
- why_it_matters: prevents a single correction from turning into a permanent rule
- promotion_signals: same correction appears again, or user says it should always apply
- lifecycle_stage: collecting_evidence
- evidence_count: 1

• Confidence: 80% confidence
• Finding: Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The markdown content is written entirely in Chinese and provides no indication that language selection is optional or constrained for a documented regional reason. This can violate language/locale policy because it imposes a specific language on users without opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This markdown file presents its operational guidance entirely in Chinese, including core instructions, examples, and behavioral descriptions. Under the policy, forcing a specific language without user opt-in or a clear region-specific justification is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: This markdown file is primarily written in Chinese, which effectively imposes a specific language on users reading or implementing the skill guidance. The policy allows locale constraints only when they are clearly justified or when users are offered a choice, neither of which appears here.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The document content is presented entirely in Chinese, beginning with the core goal statement, with no indication that language selection is optional or user-configurable. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The skill description is written in Chinese and does not indicate that language selection is optional or limited to a China-specific workflow. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The substantive guidance in this file is written entirely in Chinese, beginning at L03 and continuing through the rest of the document. Under the policy rule, forcing a specific language without opt-in is a natural-language policy violation when no alternative language option or justification is provided.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The core goal and behavior description is written in Chinese, and the document does not provide an English alternative or indicate that the skill is intended only for a Chinese-speaking or region-specific environment. This can violate language/locale policy because it imposes a specific language without user opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This markdown file presents its core objective and explanatory content in Chinese, while later sections are partly in English, but it does not state that the language is intentional, region-specific, or user-selectable. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The checklist content is written in Chinese, including the goal, requirements, and error guidance, with no indication that users may choose another language or that the document is intentionally limited to a Chinese-speaking environment. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The routing table explicitly directs many categories of captured information into persistent files such as MEMORY.md, project docs, and proactivity/session state without any accompanying minimization, consent, or sensitivity-screening guidance. In a memory-governance skill, this omission increases the chance that secrets, personal data, or sensitive project details will be durably stored and later surfaced beyond the user's expectations.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The document’s operational instructions are written entirely in Chinese, starting at the first substantive heading and continuing throughout the file. Under the stated policy, forcing a specific language without offering a user choice or documenting a justified locale constraint is a natural-language policy violation.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/check-memory-host.py:71

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/review-learning-candidates.py:37

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: memory_governor/audit/reconciliation.py:39

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/check-memory-host.py:300