ClawHub
Back to skill

Security audit

Morrow Agent Memory

Security checks for vulnerabilities and agentic risk

Overview

This memory-systems guide is mostly coherent, but its copy-paste setup exposes a persistent Neo4j database too broadly and uses unsafe install examples.

Review this before installing. The core memory advice is useful, but do not copy the Graphiti/Neo4j setup unchanged: bind services to localhost or a private network, use a generated secret outside shell history, pin package and image versions or digests, and define what data may be stored in persistent memory.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:137
Finding

Unpinned Python Dependency Installed Outside an Isolated Environment

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:141
Finding

Neo4j Exposed on All Network Interfaces with Predictable Placeholder Credentials

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest lists several specific trigger phrases, but then broadens activation to "any task involving durable state for AI agents." That catch-all condition is ambiguous and lacks clear boundaries, which could cause the skill to match many general agent-design conversations beyond the intended scope.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The skill instructs users to run a Docker image by mutable tag (neo4j:5.26) rather than a pinned digest. Mutable tags can be retargeted over time, causing non-reproducible deployments and creating a supply-chain risk if a compromised or unexpected image is later served under the same tag. In a skill that teaches persistent agent memory infrastructure, this is more dangerous because it encourages direct deployment of a stateful backend service.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium
Category
Output Handling
Confidence
80% confidence
Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · references/memory-architecture.md (reported line 59)May include surrounding context.

md
"""Subclass that injects JSON schema into prompts since Bedrock ignores response_format."""

    async def _generate_response(self, messages, response_model=None,
                                  max_tokens=None, model_size=None, **kwargs):
        openai_messages = []
        for m in messages:
            m.content = self._clean_input(m.content)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The guidance explicitly tells users to persist 'important facts' to memory files for long-term retention, but it does not warn about storing secrets, personal data, or regulated information in durable storage. In an agent-memory skill, this omission is more dangerous because the whole purpose is cross-session persistence, increasing the chance that sensitive data will be retained, reused, or exposed beyond the original context.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The documentation recommends invoking an MCP server package via npx -y @upstash/context7-mcp without pinning an exact version or integrity. That causes future executions to resolve whatever package version is current at the time, creating a supply-chain risk where a malicious update, compromised maintainer account, or breaking release could be fetched and executed implicitly. In an agent-memory skill, this is more dangerous because users may copy operational commands directly into agent toolchains that have broad data access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.