Security audit

clipboard-memory

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real clipboard-recovery helper, but it exposes broad sensitive clipboard access plus persistent and state-changing clipmem controls that deserve review before installation.

Install only if you trust the clipmem publisher and are comfortable with a persistent local clipboard archive. Before using it, restrict agents to read-only recall/search/timeline/get workflows where possible, require explicit confirmation for export, restore, delete, purge, setup, service, settings, launch-at-login, update-check, and install/uninstall commands, and avoid broad searches when the clipboard may contain passwords, tokens, private documents, or other sensitive data.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

Location: SKILL.md:5
Finding: Unpinned External Dependency Receives Persistent Access to Sensitive Clipboard Data
Content: View full analysis
/dev/null 2>&1; then CLIPMEM_PRESENT="0" fail "clipmem is not on PATH. Install via 'brew install tristanmanchester/tap/clipmem' or 'cargo install clipmem'." 2 fi ``` ### Technical Analysis The Skill delegates all clipboard capture and retrieval operations to the externally installed `clipmem` executable. Both documented installation methods resolve mutable third-party packages without specifying an exact package version, immutable source revision, expected checksum, or signature: - A package from the personal Homebrew tap `tristanmanchester/tap` - The package named `clipmem` from the Cargo registry Although the metadata declares Skill version `1.3.9`, neither installation command pins the installed executable to that version. Consequently, the reviewed Skill content does not uniquely determine which executable will be installed. This dependency is especially security-sensitive because the documentation instructs users to run it continuously as a background watcher. It can access archived clipboard t ...[truncated 2274 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says this skill is for recovering previously copied clipboard content from the local clipmem archive. The supplied code does not implement clipboard lookup, search, filtering, ranking, timeline recall, export, or pagination. Instead, it is a setup verification script focused on installation and operational health: confirming the clipmem binary exists, running 'clipmem doctor', checking FTS5 availability, querying service status, examining stale/recent capture state, pause state, service conflicts, and optional OpenClaw diagnostics. While this is related to the same product domain (clipmem), its primary purpose is materially different from the declared end-user recall behavior. Therefore the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The command reference exposes destructive and system-management operations far beyond the stated clipboard-recall purpose, including restore, delete, purge, service control, settings mutation, and app/process management. In an agent-skill context, this broadens the action surface from read-only recall into state-changing capabilities that could delete history, alter persistence, or manipulate background services if the agent is induced to use them.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documented OpenClaw/Hermes install/uninstall commands allow the skill to write or remove skill files on disk, which is unrelated to clipboard recall and creates a self-management or lateral-modification capability. In a hostile prompt or confused-agent scenario, these commands could be used to persist changes, tamper with the agent environment, or remove tooling without a user intending such actions.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 79% confidence
Finding: The skill instructs the agent to inspect local environment state, PATH availability, database write access, and service health, but it declares no explicit tool scope or permission boundary. In a security-sensitive skill that accesses clipboard history, missing scope declarations increase the chance of unintended tool use and broaden what an orchestrator may permit without clear review.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This skill is designed to surface clipboard history, which commonly contains secrets, tokens, passwords, private messages, commands, file paths, and document fragments. Failing to prominently warn about the sensitivity of clipboard archives and require clear user intent increases the risk of over-collection, accidental disclosure in chat, and privacy harm.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest markets the skill as clipboard recall/search, yet the documented command set includes mutable operations affecting settings, service state, and application behavior. Bundling read-focused and state-changing capabilities under a retrieval-oriented skill can mislead users and agents into invoking administrative actions without appreciating the side effects.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: A command to reset capture policy and ignored apps can materially change what clipboard data is collected or excluded, which exceeds simple history recall. If triggered inappropriately, it can weaken user privacy expectations, alter retention behavior, or re-enable capture from sources the user intentionally excluded.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: App control operations like changing launch-at-login, running update checks, or quitting the app are unrelated to clipboard recall and introduce unnecessary state-changing power. These actions can affect persistence, availability, and host behavior beyond the user's apparent request to recover clipboard content.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The live update-check capability introduces network-relevant behavior that is unnecessary for a clipboard-memory recall skill. Even if intended for normal app maintenance, it expands the trust boundary and can leak environment metadata or trigger external communication contrary to a user's expectation of a local-only recall tool.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 90% confidence
Finding: The documented app settings, launch-at-login, and related revision-bumping behavior enable persistent state changes that survive the current session. For a clipboard-recall skill, this is an unnecessary persistence mechanism that could be abused to alter future app behavior, enable startup execution, or silently modify user preferences beyond the immediate task.
Content: Scanner excerpt · references/commands.md (reported line 276)May include surrounding context.
md
`settings` is the persistent capture-policy entrypoint. Ignore matching is exact, case-insensitive bundle-id matching only. OCR is opt-in, runs locally through Apple Vision on macOS, and stores text/status separately from raw image bytes. `app settings`, `app launch-at-login`, and `app update-check` are menu bar app state bridges. They read and write app-local preferences without changing archive capture policy. Mutating commands bump `app_preferences_revision` so an open app can observe external agent changes. Launch-at-login writes the desired app-owned preference; the menu bar app applies it through `SMAppService`. `app update-check run` performs the live latest-stable-release lookup and updates the same cache the app reads. `app quit` requests the menu bar app to terminate through the app bundle identifier. `clipmem agents context --format json` is safe as a first call in agent sessions. It includes `generated_at`, service health, capture policy, archive revision, bounded recent activity, menu bar app state, capability discovery, and privacy guidance. It excludes raw clipboard content and representation bytes, but includes operational metadata such as app names, timestamps, counts, paths, and app preference state.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The skill is framed as preferable to generic web or repo search, suggesting a local/privacy-preserving tool, yet the same reference documents live update-check behavior elsewhere. That mismatch can mislead operators or agents about the skill's effective network behavior and result in unintended external requests under a privacy-sensitive clipboard-recovery use case.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/commands.md (reported line 280)May include surrounding context.
md
`clipmem agents context --format json` is safe as a first call in agent sessions. It includes `generated_at`, service health, capture policy, archive revision, bounded recent activity, menu bar app state, capability discovery, and privacy guidance. It excludes raw clipboard content and representation bytes, but includes operational metadata such as app names, timestamps, counts, paths, and app preference state. `clipmem service revision --format json` is the lightweight polling path for change detection. It reads the same archive revision counters surfaced in service status and agent context without checking Homebrew, LaunchAgent, or other service providers. ---

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The examples normalize searching, retrieving, and exporting historical clipboard contents—including URLs, commands, text, images, and PDFs—without any explicit privacy guardrails, consent checks, or warnings about sensitive data exposure. Because clipboard history commonly contains passwords, tokens, personal data, and proprietary material, these examples can encourage unsafe use patterns or overbroad data access by downstream agents and users.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.