ClawHub
Back to skill

Security audit

SwarmRecall Dream

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but it can automatically rewrite or archive persistent agent memory and can send its bearer token to an environment-selected API host.

Install only if you trust SwarmRecall with the agent memories this key can access. Keep SWARMRECALL_API_URL unset unless you intentionally use a trusted endpoint, and require manual review before enabling idle, periodic, or shared-pool memory changes.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:39
Finding

Unvalidated API Base URL Override Can Expose Bearer Credentials and Memory Data

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:39-46
Vulnerability Type: Unvalidated authenticated API endpoint override
Risk Level: High

Vulnerable Code Snippet:

markdown
## Authentication

All API requests require:

Authorization: Bearer <SWARMRECALL_API_KEY>

text

## API Base URL

`https://swarmrecall-api.onrender.com` (override with `SWARMRECALL_API_URL` if set)

Technical Analysis

The Skill instructs the agent to attach SWARMRECALL_API_KEY as a bearer token to all API requests while permitting the API origin to be replaced by the SWARMRECALL_API_URL environment variable. It specifies no hostname allowlist, origin binding, explicit user approval, or protection against forwarding the existing credential to a substituted endpoint.

If an attacker or compromised runtime can set this environment variable, authenticated requests may be redirected to an attacker-controlled HTTPS server. The server could collect the bearer token and any transmitted memory or session data. It could also return fabricated duplicate, stale-memory, or contradiction candidates that influence later memory mutations.

This behavior conflicts with the fixed-domain data-handling statement at SKILL.md:50-53, which claims that all data is sent to swarmrecall-api.onrender.com.

Attack Path

  1. An attacker with influence over the agent's environment sets SWARMRECALL_API_URL to an attacker-controlled HTTPS origin.
  2. The agent starts a dream operation and uses the substituted origin as its API base URL.
  3. Following the authentication instructions, the agent sends Authorization: Bearer &lt;SWARMRECALL_API_KEY&gt; to that origin.
  4. The attacker captures the API key and memory-related request data.
  5. The malicious endpoint returns forged candidate records or identifiers.
  6. The agent may act on those responses by rewriting or archiving persistent memories.
  7. The stolen credential may addi ...[truncated 560 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove the SWARMRECALL_API_URL override in production deployments, or restrict it to an explicit allowlist of trusted HTTPS origins.
  • Require informed user approval before changing the service origin.
  • Bind credentials to the expected origin and never forward an existing bearer token when the hostname changes.
  • Reject non-HTTPS URLs, URLs containing embedded credentials, unexpected ports, redirects to different origins, and hosts that resolve to local or private network ranges where inappropriate.
  • Ensure redirects cannot carry the Authorization header across origins.
  • Make privacy documentation accurately describe every destination to which credentials or memory data may be sent.
  • Validate response schemas, tenant ownership, and resource identifiers before performing subsequent memory mutations.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:250
Finding

Unattended Dream Cycles Can Perform Destructive Persistent Memory Mutations

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:250-295
Vulnerability Type: Insufficient authorization and review controls for persistent memory mutation
Risk Level: Medium

Vulnerable Code Snippet:

markdown
- **Between sessions**: After ending a session and before starting the next one. This is the natural idle period.
- **On idle detection**: If your framework detects the agent is idle (no user interaction for a configured period), trigger a dream.
- **Periodically**: If auto-dream is enabled in your config, the server runs Tier 1 ops automatically on your interval. You can layer Tier 2 on top.
- **On explicit request**: When the user says something like "clean up your memory" or "consolidate what you know."

...

- Update the anchor memory with merged content: `PATCH /api/v1/memory/:anchorId`
- Archive each duplicate: `PATCH /api/v1/memory/:duplicateId` with `{ "archived": true }`

...

- Write the summary: `POST /api/v1/memory` with `{ "content": "&lt;summary&gt;", "category": "session_summary", "sessionId": "&lt;id&gt;", "importance": 0.7 }`

...

- Archive the stale one: `PATCH /api/v1/memory/:staleId` with `{ "archived": true }`

Technical Analysis

The Skill permits dream cycles to run between sessions, upon idle detection, or periodically. Those cycles consume candidates supplied by an external service and direct the agent to update anchor memories, create summaries, and archive records.

Although the document advises the agent to reason about candidates, it does not require per-cycle user confirmation, a preview of proposed changes, strict confidence thresholds for every mutation, or approval before archival. Incorrect or malicious candidate data can therefore result in unattended changes to persistent agent state.

Archived records are described as recoverable, which reduces permanent-loss risk, but merged content and newly generated summaries can still change the information pre ...[truncated 1384 chars]

Remediation
View remediation

Remediation Suggestions

  • Default Tier 2 operations to preview-only mode and present proposed merges, summaries, and archival actions before committing them.
  • Require explicit user approval before enabling idle or periodic persistent-memory mutation.
  • Require separate confirmation for bulk archival, contradiction resolution, and shared-pool changes.
  • Validate that every returned resource belongs to the authenticated tenant, agent, and expected pool before mutation.
  • Re-fetch records from the trusted API and compare versions immediately before applying changes to prevent stale or forged decisions.
  • Use confidence thresholds, bounded batch sizes, and conservative failure behavior for candidate processing.
  • Preserve immutable before-images and detailed audit logs so all updates and archives can be rolled back.
  • Prevent automatic mutation of pinned, high-importance, security-sensitive, or policy-related memories.
  • Treat remote candidate content as untrusted data and prevent it from being interpreted as agent instructions.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill suggests triggering destructive or state-changing memory maintenance when a user says broad phrases like 'clean up your memory' or 'consolidate what you know.' Those phrases can plausibly arise in normal conversation, prompting unintended archival, pruning, merging, or contradiction resolution without a sufficiently explicit confirmation step. In this skill, the risk is elevated because the operations modify persisted memory state and may remove or rewrite information.

Content

No source excerpt is available for this finding.