ClawHub
Back to skill

Security audit

Memory Tiering

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed memory-organization helper that can change memory files, but its behavior matches its stated purpose and does not show hidden or destructive intent.

Install this only if you want the agent to reorganize memory after compaction. Review important memory files or keep backups if exact historical detail matters, because the skill may move details between tiers or replace older detail with summaries.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly instructs automatic memory reorganization after `/compact`, including moving, pruning, and archiving stored context, but it does not require explicit user notice or confirmation before these changes occur. In a memory-management skill, this creates a real integrity and transparency risk: important context may be altered, summarized, or relocated unexpectedly, making later decisions less reliable and reducing user control over retained data.

Static analysis

No suspicious patterns detected.