v1.4.0

Secretary Memory

SuspiciousClawScan verdict for this skill. Analyzed Apr 30, 2026, 12:56 PM.

Analysis

The skill is broadly aligned with memory management, but it stores and reinjects persistent personal context, signals sensitive credentials without a clear credential contract, and can automatically create or register new skills.

GuidanceInstall only if you want a persistent memory system and are comfortable reviewing what it stores. Before enabling it, disable automatic skill generation and self-improvement, require approval for hooks and consolidation, inspect generated memory/profile files, and avoid giving it secrets until the credential requirement is clearly documented.

Findings (8)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agent Goal Hijack

SeverityHighConfidenceHighStatusConcern

scripts/auto_loader.py

Returns: 上下文字符串（可直接追加到 system prompt）

Recalled memory can be appended into high-priority prompt context, so stored content may steer future agent behavior rather than remaining clearly separated reference data.

User impactA poisoned or misleading memory could influence the assistant’s future goals, priorities, or interpretation of your request.

RecommendationTreat recalled memories as untrusted reference material, do not inject them into the system prompt, and strip or quarantine imperative instructions from stored memory.

Tool Misuse and Exploitation

SeverityMediumConfidenceHighStatusConcern

SKILL.md

python3 skill-creator/auto_skill_generator.py --generate ... --register ... --improve

The skill exposes commands that generate, register, and improve skills, but the artifacts do not show clear user approval, review, rollback, or scope limits for those high-impact actions.

User impactThe agent could create or register new automation behavior that persists and changes future task handling.

RecommendationRequire explicit user approval and diff review before generating, registering, or improving any skill; constrain generated output to a reviewed directory.

Agentic Supply Chain Vulnerabilities

SeverityMediumConfidenceHighStatusConcern

SKILL.md

自动 Skill 生成 ... 同一问题出现 ≥3 次; 注册触发词; 自我改进

The skill can create and register additional skills from observed task patterns, but the artifacts do not define provenance checks, review requirements, or trust boundaries for generated components.

User impactUnreviewed generated skills could become part of the agent’s future behavior and inherit errors or poisoned instructions from past conversations.

RecommendationDisable automatic registration by default and require manual review, provenance metadata, and approval before any generated skill is installed or invoked.

Unexpected Code Execution

SeverityLowConfidenceHighStatusNote

SKILL.md

python3 session_search.py --build-index; python3 session_summary.py --watch; python3 consolidate.py --check-capacity

The skill is script-driven and expects local Python execution for memory indexing, monitoring, and consolidation. This is purpose-aligned, but users should notice that it is not purely descriptive.

User impactUsing the skill may run local scripts that read, index, summarize, or modify memory files.

RecommendationRun reviewed commands only, prefer dry-run modes where available, and inspect file changes after consolidation or monitoring actions.

Cascading Failures

SeverityMediumConfidenceHighStatusConcern

scripts/consolidate.py

daily_file.rename(archive_file); MEMORY_MD.write_text(new_content); self.update_archive_index()

Consolidation moves daily logs into archives, rewrites long-term memory, and updates indexes, so a bad or poisoned memory entry can propagate across persistent files.

User impactOne incorrect or malicious memory can be copied into archives, summaries, indexes, and future recalled context.

RecommendationUse backups, dry-run review, transactional writes, and explicit approval before consolidation or broad memory rewrites.

Rogue Agents

SeverityHighConfidenceHighStatusConcern

SKILL.md

定时 consolidation + 会话结束 hook; 会话开始时自动加载相关记忆; 自动 Skill 生成; --improve

The skill describes autonomous hooks, scheduled maintenance, persistent recall, automatic skill creation, and self-improvement, which can keep changing behavior beyond a single explicit task.

User impactThe skill may continue modifying memory or future agent behavior across sessions after the original request is complete.

RecommendationDisable hooks and self-improvement by default, require user initiation for persistent changes, and maintain an audit log of generated or modified skills.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityMediumConfidenceHighStatusConcern

metadata

Capability signals: - requires-sensitive-credentials; Primary credential: none; Required env vars: none; Env var declarations: none

The capability signal says sensitive credentials are required, while the credential contract declares no primary credential or environment variables, leaving the permission boundary unclear.

User impactYou may not know what sensitive credential or account authority the skill expects before use.

RecommendationDo not provide secrets to this skill unless the publisher documents the exact credential type, scope, storage, and purpose, or removes the sensitive-credential requirement.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Memory and Context Poisoning

SeverityHighConfidenceHighStatusConcern

SKILL.md

会话自动摘要; 偏好自动提取 + 用户关系图谱; 跨会话召回; 数据文件：memory/.user_graph.json

The skill persistently extracts, stores, and reuses user preferences, summaries, and relationship graph data across sessions, creating both privacy exposure and poisoning risk.

User impactSensitive personal details or incorrect assumptions may be stored and reused in later conversations without being obvious each time.

RecommendationMake memory capture opt-in, provide easy review/delete controls, avoid storing secrets, and label retrieved memory as untrusted context.