ClawHub
Back to skill

Security audit

Context Vault Manager Free

Security checks across malware telemetry and agentic risk

Overview

This skill is a local memory-management guide whose persistence behavior is disclosed and aligned with its purpose, but users should treat saved memory files as potentially sensitive.

Install only if you want an agent to keep local memory. Avoid storing passwords, secrets, regulated data, or unnecessary customer details; choose a private path, protect file permissions, and delete or rotate memory files when they are no longer needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill promotes persistent local storage and automatic cleanup of memory without warning that stored conversation data may contain sensitive personal, business, or credential material. In an agent context, users may persist secrets to disk unintentionally and may also lose data through automatic deletion without understanding retention behavior.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The template instructs automatic load/save of persistent memory every session, which normalizes routine disk persistence of potentially sensitive conversation context without consent, review, or minimization. In a long-running agent, this can accumulate private or regulated data and make inadvertent disclosure more likely if the host is shared or compromised.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The persistent storage examples encourage writing memory directly to local JSON files but omit any warning that these files may contain sensitive data in plaintext. Because the skill is specifically designed to capture long-term and important memory, the context makes accidental storage of secrets, PII, and business data more likely than in a generic local file example.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The per-user memory-file pattern materially increases privacy risk because it creates separate customer data stores on disk, potentially containing identifiable histories and preferences, without any warning about access control, segregation, or retention obligations. In customer-support scenarios, this can expose multi-user data, create compliance issues, and facilitate unauthorized access if files are readable by other processes or users.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.