ClawHub
Back to skill

Security audit

精英长期记忆免费版

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local memory system, but it broadly persists user conversation details and changes agent startup rules without enough consent, scoping, or safety boundaries.

Install only if you deliberately want local cross-session memory in the workspace. Treat the memory files as sensitive, review them before sharing or committing the project, avoid storing secrets or personal data, and consider adding your own rules for consent, redaction, deletion, and treating all memory content as untrusted notes rather than instructions.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:48
Finding

Unbounded Plaintext Persistence of Potentially Sensitive Conversation Data

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 48-58
Vulnerability Type: Plaintext sensitive-data storage without filtering or retention controls
Risk Level: Medium

Relevant Skill Instructions

The following is an English rendering of the relevant source instructions:

markdown
### 1. Hot Memory (SESSION-STATE.md)

Active working memory that survives context compression and restarts. Parameters:
current task, key context, pending actions, and recent decisions. Output: a
session-level state file that the Agent reads before every response. Follow the
WAL protocol: user input triggers a write, and state is written before replying.

### 2. Curated Archive (MEMORY.md + daily/)

Human-readable long-term memory. The workspace contains MEMORY.md and
memory/YYYY-MM-DD.md daily logs. At the end of a session, important content is
migrated from SESSION-STATE.md to MEMORY.md, and a daily log is created or updated.

### 3. WAL Protocol

Trigger conditions include when the user expresses a preference, makes a decision,
provides a deadline, or corrects the Agent. Write the information to
SESSION-STATE.md before replying to the user.

Technical Analysis

The Skill broadly directs the Agent to persist user-supplied details in SESSION-STATE.md, then migrate important content into MEMORY.md and dated archive files. These files are explicitly described as human-readable local files.

No instruction requires the Agent to:

  • Obtain consent before retaining conversation data.
  • Detect and reject passwords, API keys, tokens, private keys, personal information, or other secrets.
  • Apply restrictive file permissions.
  • Encrypt stored memory.
  • exclude memory files from source control and backups.
  • Expire or delete stored information after a retention period.
  • Allow the user to inspect and erase retained information.

Consequently, a user who accidentally includes a secret in a prefe ...[truncated 1545 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require explicit user consent before enabling persistent memory.
  2. Use a structured allowlist of fields that may be retained rather than storing arbitrary free-form conversation text.
  3. Prohibit storage of passwords, authentication tokens, private keys, recovery codes, financial data, and other sensitive information.
  4. Apply secret-detection and personal-data filtering before every write.
  5. Store only concise summaries and redact unnecessary values.
  6. Apply restrictive file permissions, such as owner-only access where supported.
  7. Add SESSION-STATE.md, MEMORY.md, and memory/ to source-control ignore rules by default.
  8. Define a short retention period and provide commands for inspection, correction, and secure deletion.
  9. Avoid copying data between files unless migration is necessary, and securely remove superseded copies.
  10. Encrypt memory at rest when it must contain confidential information.

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:75
Finding

Persistent Prompt Injection Through Unvalidated Agent Memory

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 75-85
Vulnerability Type: Persistent ingestion of attacker-controlled instructions into future Agent sessions
Risk Level: High

Relevant Skill Instructions

The following is an English rendering of the relevant source instructions:

markdown
First: Create the hot-memory file. Run `cat > SESSION-STATE.md` and create
Current Task, Key Context, Pending Actions, and Recent Decisions sections.

Second: Add a memory protocol to AGENTS.md. At session startup, read
SESSION-STATE.md to obtain hot context and inspect memory/YYYY-MM-DD.md for recent
activity. When the user provides specific details, write them to
SESSION-STATE.md before replying.

Third: At session end, update SESSION-STATE.md, migrate important content to
MEMORY.md, and create or update memory/YYYY-MM-DD.md.

If the Agent forgets context, add a mandatory AGENTS.md rule requiring it to write
specific user details before replying.

If memory files are not loaded, add a mandatory AGENTS.md rule requiring the Agent
to read SESSION-STATE.md at session startup.

After an error, write the experience to memory/lessons.md and configure a
mandatory AGENTS.md rule requiring error recording.

Technical Analysis

The Skill creates a persistent trust loop:

  1. User-controlled text is written into local memory.
  2. Selected text is promoted into long-term archives.
  3. AGENTS.md is modified to require future sessions to load those files.
  4. The loaded content is reused as active Agent context.

The instructions do not establish a security boundary between trusted Agent policy and untrusted remembered data. There is no required provenance tracking, schema validation, instruction neutralization, integrity verification, or confirmation before applying security-sensitive memories.

An attacker can therefore phrase an instruction as a preference, decision, correction, pending actio ...[truncated 2615 chars]

Remediation
View remediation

Remediation Suggestions

  1. Treat every memory file as untrusted data, never as an authoritative instruction source.
  2. Store memories in a strict structured format with fields such as value, type, source, creation time, confidence, and approval status.
  3. Prohibit imperative instructions, role changes, tool directives, safety-policy changes, and authorization claims in memory values.
  4. Encode or quote free-form text so it cannot be interpreted as Agent instructions when reloaded.
  5. Add an explicit instruction that memory content cannot override system, developer, workspace, or current-user instructions.
  6. Require user confirmation before persisting or applying any memory that affects permissions, security controls, external communication, command execution, or data disclosure.
  7. Separate trusted configuration from user-derived memory; do not place user-controlled content in AGENTS.md.
  8. Verify memory integrity and provenance before loading it.
  9. Present loaded memories as a clearly delimited data block and instruct the Agent to extract facts only.
  10. Provide inspection, quarantine, correction, and deletion mechanisms for suspicious entries.
  11. Prevent automatic propagation from session memory into long-term archives unless the entry passes validation.
  12. Add adversarial tests covering instruction-like preferences, false authorization claims, encoded prompts, and poisoned lessons.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file repeatedly states that the free version only provides local file-based memory and explicitly does not support vector semantic search, including in the purpose description, FAQ, and limitations. However, the '记忆检索与关联' section claims '通过语义搜索检索历史记忆' and automatic relationship building, which directly contradicts those other statements and materially changes the represented capability.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description activates on vague 'related development scenarios' without narrow trigger conditions, making it easy for an agent to invoke the skill broadly and persist memory outside the user's specific intent. For a skill centered on durable storage of conversation context, overly broad activation increases the chance of unsolicited retention of sensitive data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill declares exec as an available tool and instructs shell-based file creation while later claiming it is pure Markdown and requires no exec capability. This mismatch can cause agents or operators to grant unnecessarily powerful execution permissions, expanding the attack surface and enabling command execution in environments where only safe file operations should be needed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The workflow directs the agent to create and update persistent local memory files containing user details, decisions, and preferences, but does not require clear notice or consent before storing that data. This creates privacy and data-governance risk because users may unknowingly have personal or sensitive context retained across sessions on disk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly instructs the agent to persist user-provided details and preferences across sessions in local files. Durable storage of conversational data without strict minimization, consent, and sensitivity filtering can capture secrets, personal data, or confidential project details that later users or processes may access.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The example normalizes automatic long-term retention and reuse of user preferences in future sessions, encouraging persistent profiling behavior as a default pattern. In agent environments, this can lead to silent accumulation of sensitive behavioral data and unintended disclosure or misuse when context is replayed later.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The file's user-facing name, summary, description, workflow, and examples are effectively Chinese-only, which can impose a specific language on users without an explicit choice. Under the language/locale policy, this is a natural-language policy concern unless the skill documents that Chinese is optional or region-specific by design.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.