ClawHub
Back to skill

Security audit

Session Sync

Security checks for vulnerabilities and agentic risk

Overview

This skill openly implements cross-session memory sharing, but it reads other session histories and stores broad conversation-derived state without clear consent, identity scoping, or redaction controls.

Install only in an environment where all shared sessions and memory files belong to the same trusted user or team. Do not use it for mixed-user, multi-tenant, or sensitive conversations unless session access is authorization-enforced and memory writes are reviewed, redacted, and scoped.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:26
Finding

Cross-Session Conversation History Access Without Authorization Checks

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 26-34
Vulnerability Type: Cross-session authorization boundary violation
Risk Level: High

Vulnerable Code

text
4. Check whether there are other active sessions:

sessions_list(activeMinutes=120, messageLimit=3)

If another session has recent activity, read its history to understand the context:

sessions_history(sessionKey="<key>", limit=10)

The excerpt above is an English rendering of the instructions at the cited location. The executable API call names and parameters are unchanged.

Technical Analysis

The Skill directs every session to enumerate other sessions active within the previous 120 minutes and then retrieve up to ten messages from their histories. It does not require verification that:

  • The current and target sessions belong to the same authenticated user.
  • The sessions belong to the same tenant, organization, or trust domain.
  • The user has consented to cross-channel history sharing.
  • The target session is on an approved allowlist.
  • Sensitive fields are redacted before the retrieved history is exposed to the current session.

This behavior violates least privilege because a session only needs its own context unless cross-session access has been explicitly authorized. A session with access to the session-management tools could use the documented workflow to retrieve conversation content from Feishu, webchat, or another channel.

The Skill does not itself bypass the underlying API's access controls. Exploitation therefore requires the Agent's session tools to permit the caller to enumerate or read another session. Where those tools expose sessions from multiple users or trust domains, the Skill provides a direct procedure for unauthorized access.

Attack Path

  1. An attacker gains access to a webchat, Feishu, or other session that can invoke the Skill.
  2. The Skill calls `session ...[truncated 1188 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not enumerate or retrieve other sessions by default.
  2. Require explicit, informed user consent before each cross-session synchronization operation.
  3. Verify that the current and target sessions belong to the same authenticated principal, tenant, and approved trust domain.
  4. Maintain an allowlist of session keys or channels authorized for synchronization instead of processing all recently active sessions.
  5. Enforce authorization in the session API itself rather than relying only on natural-language Skill instructions.
  6. Return only a user-approved, redacted summary rather than raw conversation history.
  7. Remove credentials, authentication tokens, personal data, and other secrets before importing cross-session content.
  8. Record auditable metadata identifying the requesting session, target session, user approval, and information transferred.
  9. Fail closed when session ownership or authorization cannot be verified.

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:36
Finding

Unvalidated Conversation Content Is Persisted and Reused Across Sessions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 36-70
Vulnerability Type: Persistent memory poisoning through untrusted session content
Risk Level: High

Vulnerable Code

text
During session operation, immediately write to memory whenever:
- A new task is started
- An important decision is made
- New information is obtained
- A task is completed
- The topic changes

Write to:
- memory/YYYY-MM-DD.md — daily raw log
- memory/SESSION-STATE.md — current active task state, overwritten on update

Before session termination or during an idle period, update:

# Session State

## Last Updated
- Time: YYYY-MM-DD HH:MM
- Channel: feishu / webchat
- Session key: xxx

## Current Tasks
- [Task name]: status and next step

## Recent Important Decisions
- [Decision]: rationale

## Follow-up Items
- [Item]: when to follow up

The excerpt above is an English rendering of the complete vulnerable instruction segment. File names, field structure, and behavior are preserved.

Technical Analysis

The Skill mandates persistent storage whenever the Agent obtains new information, starts a task, makes a decision, completes a task, or changes topics. It also instructs future sessions to read daily logs, long-term memory, and memory/SESSION-STATE.md.

No validation or trust boundary separates user-controlled conversation content from persistent Agent state. The instructions do not require:

  • User confirmation before storing information.
  • Separation of facts from untrusted claims or embedded instructions.
  • Sanitization of prompt-like or executable content.
  • Source attribution or confidence metadata.
  • Secret and personal-data redaction.
  • An expiry period for active state.
  • Approval before promoting content into long-term MEMORY.md.

As a result, an attacker can present malicious rules, false facts, or misleading task state as new informati ...[truncated 2181 chars]

Remediation
View remediation

Remediation Suggestions

  1. Treat all conversational content as untrusted input and never persist user-supplied instructions as authoritative Agent policy.
  2. Require explicit user approval for each memory entry, especially decisions, identity details, preferences, and cross-session tasks.
  3. Store structured data with fields for source session, author, timestamp, confidence, trust level, expiry, and approval status.
  4. Separate factual summaries from instructions. Reject or quarantine content containing tool commands, policy changes, hidden directives, or requests to override future behavior.
  5. Apply secret scanning and redact credentials, tokens, session keys, personal data, and confidential values before writing any memory file.
  6. Permit future sessions to consume only validated records, not raw conversation logs.
  7. Require a separate confirmation and review step before moving information into long-term MEMORY.md.
  8. Apply retention limits to SESSION-STATE.md and MEMORY.md, not only to date-named logs.
  9. Isolate memory by authenticated user and tenant; do not share one workspace memory directory across unrelated principals.
  10. When loading memory, clearly mark it as historical, potentially untrusted context and prevent it from superseding system instructions or current user authorization.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description says this skill ensures memory consistency across multiple channels, implying synchronization or reconciliation logic between systems like Feishu and webchat. The supplied code does not implement any cross-session or cross-channel sync behavior. Instead, it operates only on local filesystem markdown files in a memory directory, identifies files older than 7 days based on filename dates, and moves them into an archive folder. This is a materially different primary purpose: retention management/cleanup rather than memory synchronization.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The startup flow tells the agent to inspect other active sessions and read their recent histories to recover context. This enables plain-language exposure of prior conversation contents across channels or users sharing the same environment, potentially disclosing sensitive information outside the original session boundary.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill directs the agent to persist broadly defined 'new information,' decisions, task context, and topic changes into shared memory files across sessions. This creates a natural-language data-retention mechanism that can capture sensitive user content without minimization, consent, or scoping, making cross-channel leakage and over-collection likely.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The skill instructs automatic execution of a local shell script during session startup and via a user command, creating an unnecessary code-execution pathway for a memory-management skill. Even if the referenced script is intended only for cleanup, invoking shell scripts from documentation expands the attack surface and could enable unintended file operations or abuse if the script or path is modified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill describes automatic archival of memory logs after 7 days without clear notice, consent, or retention safeguards. Moving conversation-derived memory files can affect availability, auditability, and user expectations around storage and deletion, especially when the data may contain sensitive cross-session context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The operational instructions and command descriptions are written entirely in Chinese, with no indication that another language can be used or that the locale is intentionally limited. This may violate language-choice policy if the skill is expected to support users without prior Chinese opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.