ClawHub
Back to skill

Security audit

memory-digest

Security checks for vulnerabilities and agentic risk

Overview

This skill reads local agent memory logs to produce a user-facing digest, and the inspected files disclose that behavior without evidence of exfiltration or hidden persistence.

Install this if you want an agent to summarize its local memory logs. Treat the generated report as potentially sensitive, invoke it with clear intent, and only use --out or cron scheduling in locations and channels you are comfortable storing or receiving agent activity history.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documented trigger phrases include broad natural-language requests such as 'what did my agent do' and 'weekly digest', which can plausibly appear in ordinary conversation and cause the skill to activate unintentionally. Because this skill reads and summarizes memory logs, accidental activation could expose historical agent activity or sensitive memory contents in contexts where the user did not explicitly intend to invoke this reporting function.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger examples include broad natural-language requests such as weekly digest, what did my agent do, and work report, which can overlap with ordinary conversation and cause the skill to activate in contexts the user did not clearly intend. In this skill, unintended activation is more concerning because it summarizes the agent's memory corpus, which may expose sensitive historical activity or internal notes unnecessarily.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
79% confidence
Finding

The skill invokes a local script and explicitly documents output to a file (--out report.md), but the manifest declares no permissions or allowed-tools scope. That mismatch can cause the runtime to grant broader implicit file access than intended or leave operators without clear visibility into the skill's read/write needs. In this context the behavior appears intended for legitimate reporting, but undeclared filesystem capabilities still weaken least-privilege controls.

Content

No source excerpt is available for this finding.