ClawHub
Back to skill

Security audit

Memory System Sidecar

Security checks for vulnerabilities and agentic risk

Overview

This skill is a scoped helper for running and checking a project memory sidecar, with disclosed local file regeneration and no evidence of hidden network access, privilege escalation, or deceptive behavior.

Install this only for the MemoryLab repo or a repo with the same memory-system layout. Before running refresh or rebuild commands, expect local memory/context files and indexes to be regenerated, and avoid invoking it from vague requests unless you intend to operate the memory sidecar.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger phrases for refreshing memory are very broad and map closely to normal user language, so an agent could invoke this skill from casual requests without clear user intent to operate the memory sidecar. In this skill, invocation can lead to shell script execution over sensitive repo state and historical transcripts, which raises the risk of unintended processing of persistent memory artifacts.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The phrase 'run the checks' is ambiguous and could match many unrelated user requests, causing the verification workflow to run outside its intended scope. Although the described action is verification rather than direct mutation, it still executes repo scripts and may consume resources or expose information from tests/evals unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file documents the refresh workflow and enumerates several artifacts that are regenerated, which implies file writes affecting user or project state. However, it does not provide a clear user warning near the refresh command that running it will overwrite or regenerate these files, which is the type of data-affecting behavior SQP-2 covers for markdown files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.