ClawHub
Back to skill

Security audit

mem-format

Security checks for vulnerabilities and agentic risk

Overview

This skill is a narrowly scoped memory-bank formatting workflow that edits local markdown files as its stated purpose and includes backup/rollback safeguards.

Before running this skill on `all` or a whole category, confirm the target files and keep or review the generated backups. Prefer starting with one or two files if the memory bank contains important hand-written notes.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill is explicitly designed to scan and rewrite user memory-bank files, but the description and usage text do not clearly warn that invoking it will modify files in place. In an agent setting, unclear disclosure around destructive or persistent file changes can lead to unintended overwrites, trust boundary violations, and loss of user-authored content even if backups are mentioned later in the workflow.

Static analysis

No suspicious patterns detected.