ClawHub
Back to skill

Security audit

cli-memo

Security checks for vulnerabilities and agentic risk

Overview

The skill searches private knowledge and records findings, with clear account boundaries and owner approval for mailbox deletion.

Use this skill when you intend to consult private records, and select only relevant accounts. Consider MEMO_READ_ONLY=1 for search-only use. Review mailbox-deletion previews carefully and retain owner control over project decisions if desired. The external npm implementation was not audited here.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

The activation description includes any question about a person or project without requiring an intent to search the owner's stored context.

Medium
Category
Trigger Abuse
Confidence
90% confidence
Finding

The activation description includes questions about any person or project without requiring a request to consult the owner's private records. This can route ordinary informational questions into searches across private messages, mail and notes, unnecessarily exposing personal or organizational information in the answer. Account-selection and proposal-confirmation safeguards reduce other risks but do not establish that the user intended private-context retrieval.

Content

No source excerpt is available for this finding.

The skill includes remote mailbox deletion and restoration, beyond its stated search-and-record purpose.

Medium
Category
Excessive Agency
Confidence
97% confidence
Finding

L086–L087 instruct the agent to move mail into Gmail's Trash and undo those changes through restore commands. These operations modify the owner's remote mailbox rather than search existing knowledge or record facts, memories, and key documents; requiring owner approval mitigates the risk but does not resolve the manifest mismatch.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.