ClawHub
Back to skill

Security audit

Hippocortex

Security checks for vulnerabilities and agentic risk

Overview

This memory skill is purpose-aligned, but it automatically sends and stores conversation content in an external persistent memory service with limited user control.

Install only if you are comfortable with conversation-derived queries, selected exchanges, and extracted facts being sent to Hippocortex or a configured self-hosted endpoint and retained across sessions. Use a dedicated low-privilege API key, avoid storing secrets or regulated data in conversations, verify the base URL, protect any .hippocortex.json file, and look for memory review and deletion controls before relying on it for sensitive work.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T02 · Agent Memory Poisoning

Warning
Location
SKILL.md:57
Finding

Persistent Memory Content Is Reintroduced Without Trust Boundaries

Content
View full analysis
", "maxTokens": 2000 }' ``` Response contains a `memories` array. Incorporate relevant memories into your answer naturally. Do not dump raw memory output to the user. **If synthesize fails:** Still answer the user. Memory is additive, not blocking. Log the error silently and continue. ### After important exchanges: Capture Store the conversation when it contains memorable content. ```bash curl -s -X POST "$BASE_URL/v1/capture" \ -H "Authorization: Bearer $HIPPOCORTEX_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "sessionId": "'"$SESSION_ID"'", "type": "conversation", "payload": { "messages": [ {"role": "user", "content": ""}, {"role": "assistant", "content": ""} ] }, "metadata": { "extractedMemories": [ "User prefers dark mode", "Project X uses PostgreSQL 16" ] } }' ``` The `extractedMemories` array is critical -- it stores discrete semantic facts directly. Extract 1-5 concise facts from the exchange. ``` ### Technical Analysis The Skill persists user-controlled conversation content and later instructs the agent to incorporate retrieved memories before answering every message. It does not define a security boundary between factual memory data and executable natural-language instructions. There are no documented controls for: - Detecting or excluding instruction ...[truncated 1858 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:18
Finding

Bearer Credentials Can Be Redirected Through User-Controlled Base URL Configuration

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs the agent to send user-derived queries, conversations, and extracted facts to an external API and store them persistently, but it does not present a clear user-facing warning or consent step. This is dangerous because users may disclose personal, confidential, or regulated information without realizing it will be retained off-platform across sessions.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup-guide.md (reported line 22)May include surrounding context.

bash
git clone https://github.com/hippocortex/hippocortex-os.git
cd hippocortex-os
cp .env.example .env
# Edit .env with your configuration
docker compose up -d

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup-guide.md (reported line 23)May include surrounding context.

git clone https://github.com/hippocortex/hippocortex-os.git cd hippocortex-os cp .env.example .env

Edit .env with your configuration

docker compose up -d

text

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger list includes very broad terms such as 'memory', 'remember', and 'recall', which are likely to appear in ordinary conversations and can cause the skill to activate unintentionally. In this skill's context, unintended activation is more dangerous because activation leads to querying and potentially persisting user conversation data to an external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The skill sends user-derived content to an external endpoint via HTTP requests, including memory queries and later conversation payloads, which is an external data transmission channel. In isolation external transmission can be legitimate, but here it is risky because the transmitted content may include sensitive user context and the skill does not require clear consent before use.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

Query memory for relevant context before composing your response.

bash
curl -s -X POST "$BASE_URL/v1/synthesize" \
  -H "Authorization: Bearer $HIPPOCORTEX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Ssd 3

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The capture flow directs the agent to persist full user/assistant exchanges along with extracted memories across sessions, which creates a broad natural-language retention surface. That increases the chance of storing secrets, personal data, or sensitive business information that may later be retrieved in an unintended context.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guidance explicitly encourages storing personal facts, preferences, corrections, people/project information, and procedures, which promotes over-collection of sensitive information. Because the skill is designed for persistent cross-session memory, this context makes broad capture more dangerous by normalizing long-term retention of data the user may not expect to be stored.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
78% confidence
Finding

The skill authorizes the agent to decide on its own when to capture and retain information, without requiring user confirmation for each save. That autonomy is risky in a memory skill because classification mistakes can cause private or sensitive content to be stored persistently and later resurfaced.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md
Skip capture for:
- Casual greetings or small talk
- Simple yes/no confirmations
- Pure command execution (just running a script)
- Repeated information already in memory

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The guide instructs users to export an API key and later place secrets in a plaintext configuration file, but it does not warn about shell history, process inspection, file permissions, or secret storage hygiene. This is not overtly malicious, but it can lead to accidental credential exposure in common operator workflows.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/setup-guide.md (reported line 72)May include surrounding context.

Test your configuration by running a synthesize call:

bash
curl -s -X POST "${HIPPOCORTEX_BASE_URL:-https://api.hippocortex.dev}/v1/synthesize" \
  -H "Authorization: Bearer $HIPPOCORTEX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"sessionId": "test", "query": "hello", "maxTokens": 100}'

Static analysis

No suspicious patterns detected.