ClawHub
Back to skill

Security audit

cli-memo

Security checks for vulnerabilities and agentic risk

Overview

The skill supports searching and recording your private information, with disclosed safeguards for account access and mailbox changes.

Use only the accounts you intend to search. Prefer read-only mode for retrieval, and review mailbox-change previews before approving them. MCP's 'ask' permission does not display a confirmation prompt, so configure write access carefully.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

The skill includes destructive mail management beyond its stated search-and-record purpose.

Medium
Category
Excessive Agency
Confidence
96% confidence
Finding

The manifest at L004 describes finding information and recording knowledge, but L079–L089 instruct the agent to manage exclusion rules, remove already stored mail with memo mail rules apply --yes, and move remote Gmail messages to Trash with memo mail delete. These are destructive mailbox and retention operations, not implementation details of searching or recording knowledge. Owner approval and previews reduce execution risk but do not resolve the mismatch with the declared purpose.

Content

No source excerpt is available for this finding.

Activation includes generic questions about any person or project without requiring a request for the owner's stored context.

Low
Category
Trigger Abuse
Confidence
88% confidence
Finding

The instruction to use the skill 'when asked about a person, a project, what was agreed' extends beyond requests to retrieve the owner's messages, mail, or notes. Although the preceding description explains the skill's purpose, this activation clause could also match general biography questions or project advice that do not require private-store access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.