Security audit

Clude Memory MCP

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed memory MCP server, but it asks for highly privileged database access and exposes persistent full-memory storage and retrieval without clear user or tenant controls.

Install only in a tightly scoped personal or test environment unless the publisher adds least-privilege Supabase credentials, authentication and tenant isolation, enforced input limits, retention and deletion controls, and a pinned reviewed package version. Do not store secrets, regulated personal data, or cross-user memories in it as currently documented.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: server.ts:22
Finding: Memory Tools Lack Authorization and Tenant Isolation
Content: View full analysis
{ const memories = await recallMemories({ query: args.query, tags: args.tags, relatedUser: args.related_user, memoryTypes: args.memory_types as MemoryType[] | undefined, limit: args.limit, minImportance: args.min_importance, }); return { content: [{ type: 'text' as const, text: JSON.stringify({ count: memories.length, memories: memories.map(m => ({ id: m.id, type: m.memory_type, summary: m.summary, content: m.content, tags: m.tags, importance: m.importance, decay_factor: m.decay_factor, created_at: m.created_at, access_count: m.access_count, })), }, null, 2), }], }; } ); ``` ```typescript server.tool( 'store_memory', 'Store a new memory in Clude\'s cognitive system. Memories persist across conversations and decay over time if not accessed.', ...[truncated 4406 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:48
Finding: Setup Installs an Unpinned and Unaudited External Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: server.ts:72
Finding: Documented Memory Size Limits Are Not Enforced
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill description and documented behavior do not cleanly match: it presents itself as a memory-focused MCP server but also exposes unrelated market-mood retrieval and external Claude-powered chat features, while advertised capabilities like dreaming, Solana commitment, and association graphs are not evidenced here. This kind of overclaiming and scope drift is dangerous because users and downstream agents may grant trust, permissions, or sensitive data based on an inaccurate understanding of what the skill actually does.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly states that memories persist across conversations and that ask_clude calls the Claude API, but it does not provide a clear user-facing warning that submitted content may be stored long-term and transmitted to third-party services. In a memory system, this increases the risk of users or agents sending secrets, personal data, or regulated information under the false assumption that data is ephemeral or local-only.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The recall_memories tool returns full memory content, not just summaries or metadata, and does so through plain-language search filters. That creates a straightforward disclosure path for previously stored user or agent data, especially if sensitive content was persisted earlier and access controls are weak or absent.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The tool description explicitly advertises retrieval of stored memories via natural-language search, and the implementation includes full content in results. In the context of a persistent cognitive memory system, this materially raises the chance of broad retrieval of prior user/agent data beyond the immediate session.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The store_memory tool is designed to persist arbitrary content across conversations, including related user identifiers and free-form text, without any visible retention notice, consent mechanism, or data-minimization control at this interface. In a memory skill, this makes privacy risk more acute because users and integrating agents may treat conversational text as ephemeral when it is actually stored long-term.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The storage interface encourages saving arbitrary conversation content as durable memory across sessions, which can normalize over-collection and retention of personal, confidential, or regulated data. Because the skill’s core purpose is long-lived memory, the danger is amplified rather than reduced: persistence is intentional, so misuse or overreach has lasting impact.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is presented as a memory-system MCP server, but it also exposes market-state retrieval and a general-purpose LLM interaction tool. This scope expansion increases attack surface and can let an integrating agent invoke capabilities the user or operator may not expect, including external model calls and unrelated data access.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The ask_clude tool enables general external LLM querying, which is not necessary for a memory server and introduces data egress to a third-party API. An upstream agent may forward sensitive prompts or recalled memory content into this tool, creating confidentiality, cost, and policy-boundary risks.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.