ClawHub
Back to skill

Security audit

Memory Distiller

Security checks for vulnerabilities and agentic risk

Overview

This skill is a memory-log compression guide that uses local file reads and simple file maintenance commands in ways that match its stated purpose.

Install only if you want an agent to process local memory logs and update MEMORY.md. Before use, confirm the actual compression script exists, review the target input and output paths, and approve append or archive operations so important logs are not moved unexpectedly.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly instructs the agent to run shell commands and move or append local files, but it does not clearly warn users that it will execute commands with local filesystem side effects. This can lead to unintended file modification, data movement, or trust abuse if a user invokes the skill without understanding that it performs `exec`, writes to `MEMORY.md`, and archives files.

Static analysis

No suspicious patterns detected.