Clude Memory

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:06 AM UTC
• Version: 1.0.1

Overview

The skill appears to be a real persistent-memory integration, but it needs review because it runs mutable npm code and encourages broad long-term storage of personal context.

Install only if you are comfortable granting an MCP memory server persistent access to agent context. Prefer a pinned, reviewed clude-bot version, avoid cloud mode unless you intentionally want sync, review imported memory files first, and tell the agent not to store sensitive personal data or secrets unless you explicitly approve it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/install.sh:13

Finding

Unpinned Third-Party npm Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: scripts/install.sh:13-18
Vulnerability Type: Unpinned and unverified third-party dependency execution
Risk Level: Medium

bash

# Install clude-bot globally
echo "📦 Installing clude-bot..."
npm install -g clude-bot 2>/dev/null || npx clude-bot --version

# Run MCP install (auto-detects Claude Desktop, Cursor, etc.)
echo "⚙️ Configuring MCP server..."
npx clude-bot mcp-install --local 2>/dev/null || echo "MCP auto-install not available. See SKILL.md for manual config."

Technical Analysis

The installation script installs and executes clude-bot without pinning an exact reviewed version or verifying package integrity. Both npm install -g clude-bot and npx clude-bot resolve a mutable package release from the npm registry. Consequently, the code executed at installation time can differ from the code reviewed during this audit.

A package lifecycle script or CLI entry point runs with the privileges of the user invoking the installer. The global installation also modifies the user's shared Node.js environment. Redirecting standard error to /dev/null suppresses security-relevant diagnostics that could otherwise reveal registry, integrity, lifecycle-script, or execution failures.

The same unsafe pattern also appears in the documented installation and runtime configuration at SKILL.md:63, SKILL.md:71-72, and SKILL.md:196.

Attack Path

1. An attacker compromises the clude-bot npm publisher account, registry release process, or another component of its dependency supply chain.
2. The attacker publishes a malicious release under the existing package name.
3. A user or agent runs scripts/install.sh or follows the unpinned commands in SKILL.md.
4. npm or npx resolves and downloads the attacker-controlled current release.
5. Package lifecycle scripts or the package CLI execute locally.
6. The malicious code acts with the invoking user's permiss ...[truncated 663 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin clude-bot to an exact reviewed version in every installation and execution command, rather than relying on the latest registry release.
2. Use a project-local dependency with a committed lockfile instead of a global installation.
3. Enforce package integrity through lockfile integrity metadata, trusted registry configuration, and package provenance or signature verification where available.
4. Configure the MCP server to invoke a verified local binary rather than resolving the package dynamically through npx on each launch.
5. Disable lifecycle scripts with --ignore-scripts where functionality permits, or explicitly audit every required lifecycle script before allowing it.
6. Remove 2>/dev/null so installation and integrity failures remain visible and actionable.
7. Apply the same version pinning and verification controls to the commands and MCP configuration documented in SKILL.md.
8. Run installation and the MCP server under a dedicated, least-privileged account with narrowly scoped filesystem and credential access.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest markets the skill as 'fully offline,' but the body also describes optional cloud mode, sync across devices, external benchmark and package links, and other web-backed integrations. This mismatch can mislead users and reviewers into overtrusting the privacy/network posture, causing deployment in environments that require strict offline guarantees.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Telling the agent to call remember 'naturally during conversations' encourages broad, continual persistence without strong boundaries for consent, sensitivity, or relevance. In practice this can lead to over-collection of personal data, retention of unnecessary confidential context, and inadvertent storage of secrets that later become retrievable.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The skill instructs users to execute npx clude-bot without pinning a specific version, which allows whatever package version is current at install/runtime to be fetched and executed. Because npx can run newly published package code, a compromised maintainer account, malicious update, or dependency hijack could lead to arbitrary code execution in the agent environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The MCP configuration uses npx with an unpinned package name, meaning future executions may resolve to a different package version than the one originally reviewed. In an MCP context this is especially dangerous because the server process may be launched automatically by the host, turning a package supply-chain compromise into repeated arbitrary code execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill strongly encourages persistent storage of names, preferences, working style, opinions, values, deadlines, and similar personal context, but does not present an upfront privacy warning proportionate to the sensitivity and persistence of that data. This increases the risk of collecting personal profiles without informed consent, especially because the tool is framed as something to use by default at session start and throughout conversations.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md

- **episodic** — Events and interactions ("We debugged the auth flow on March 5")
- **semantic** — Facts and knowledge ("User's app uses Next.js + Supabase")
- **procedural** — How-tos and patterns ("Deploy process: push to main, Railway auto-deploys")
- **self_model** — What you've learned about yourself ("I tend to over-explain, keep it concise")

When storing, pick the right type. It helps with retrieval later.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The import command again relies on unpinned npx package execution, exposing users to supply-chain risk when importing local memory files. Although this is a one-shot CLI invocation rather than a persistent server config, it still executes remote package code with access to local files specified by the user.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This directory import example executes an unpinned package that will process an entire local memory directory, amplifying exposure if the package is malicious or compromised. The risk is slightly broader than a single-file import because the command is encouraged to ingest many potentially sensitive documents at once.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The script installs and then falls back to executing 'npx clude-bot --version' without a pinned package version. Unpinned npm/npx resolution can fetch the latest package or a substituted package if the registry, dependency chain, or namespace is compromised, creating a supply-chain execution path during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The command 'npx clude-bot mcp-install --local' runs an unpinned package to perform local MCP configuration. Because this is an installer for an agent skill, successful compromise could alter agent runtime configuration, persistence, or tool wiring, making the context more sensitive than a normal one-off CLI invocation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The script instructs users to run 'npx clude-bot mcp-serve --local' without version pinning. That creates an ongoing path to execute whatever package version resolves at runtime, which is especially risky for an MCP server because it may handle agent data, memory, and tool interactions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.