ClawHub
Back to skill

Security audit

Memory Fortress

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent memory system, but it asks agents to persist broad user and conversation data across sessions with insufficient scoping and rollback controls.

Install only if you want a durable, file-based memory workflow across sessions. Before using it, narrow what gets saved, avoid exact quotes for sensitive requests, add redaction and retention rules, and be cautious about copying its rules into a global agent manual.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:70
Finding

Persistent Replay of Untrusted User Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43-52 and 70-85
Vulnerability Type: Persistent memory poisoning through verbatim storage of untrusted user input
Risk Level: High

Vulnerable Code

text
1. state/HOLD.md        — what is blocked? do not do these
2. state/ACTIVE.md      — is there an active task?
3. state/DECISIONS.md   — recent decisions, last 48h
4. state/CLOSED.md      — durable closed decisions, not to be reopened casually
5. IDENTITY.md          — who the agent is
6. SOUL.md              — learned style and operating principles
7. USER.md              — who the agent serves
8. memory/YYYY-MM-DD.md — today + yesterday
9. MEMORY.md            — long-term knowledge, main session only
markdown
When the user gives you a task:

1. **Immediately** write their **exact words** to `state/ACTIVE.md`
2. Then interpret the request
3. Then do the work
4. When done, update or clear ACTIVE

### `state/ACTIVE.md` format
```markdown
## Active task
**User said:** "[exact quote]"
**Interpretation:** [what you believe it means]
**Status:**
- [ ] Step 1
- [ ] Step 2
**Updated:** YYYY-MM-DD HH:MM
text

### Technical Analysis

The Skill requires arbitrary user-controlled text to be written verbatim to `state/ACTIVE.md`. It does not require sanitization, trust labeling, instruction neutralization, or separation of user data from executable agent instructions.

The boot sequence then directs the agent to load `state/ACTIVE.md` during every subsequent session. Consequently, adversarial instructions embedded in a task can cross a session boundary and be reintroduced into the agent's active context. Merely storing an exact quote is not inherently unsafe, but loading that quote as operational context without requiring it to be treated as inert data creates a persistent prompt-injection channel.

### Attack Path

1. An attacker submits a task containing embedded 
...[truncated 1226 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not persist exact user text by default. Store a concise, task-specific summary containing only the information required for continuity.
  2. If an exact quotation is necessary, place it in a clearly delimited data field and explicitly state that its contents are untrusted and must never be followed as instructions.
  3. Reject or neutralize embedded directives that attempt to modify system rules, memory policy, tool permissions, or future-session behavior.
  4. Require explicit user confirmation before persisting sensitive or unusually broad task content.
  5. During boot, parse state/ACTIVE.md as structured data rather than injecting its raw contents into the operational prompt.
  6. Revalidate all recovered instructions against the current user request and higher-priority policies before acting.
  7. Apply expiration and deletion controls so stale active-task records cannot remain indefinitely.
  8. Add provenance fields identifying the author, creation time, trust level, and confirmation status of each persisted entry.

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:463
Finding

Persistent Modification of Global Agent Operating Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 463-464
Vulnerability Type: Persistent instruction hijacking through modification of the agent manual
Risk Level: High

Vulnerable Code

markdown
### 5. Update your agent manual
Add the boot sequence, the write-before-lose rule, the documentation-first project pattern, and the failsafe `ORIENT.md` reorientation layer.

Technical Analysis

The installation instructions direct the operator to copy the Skill's behavioral rules into the agent manual. An agent manual is global or durable operational configuration rather than invocation-scoped Skill data. Modifying it allows the Skill's instructions to remain active even when the Skill is not explicitly invoked and potentially even after the Skill package is removed.

The copied rules include automatic memory loading, persistent storage of task content, project-file creation, and reorientation behavior. This expands the Skill's influence from a single execution into unrelated future sessions without defining scope restrictions, conflict-resolution rules, an uninstall procedure, or a mechanism for restoring the previous manual.

Attack Path

  1. An operator installs or reviews the Skill and follows its installation instructions.
  2. The operator adds the specified rules to the global agent manual.
  3. Future sessions load the modified manual regardless of whether Memory Fortress is explicitly invoked.
  4. The agent automatically performs Skill-defined boot, storage, and recovery behavior in unrelated tasks.
  5. Removing or disabling the original Skill does not remove the copied instructions.
  6. Persistent behavior continues until the global manual is manually inspected and restored.

Impact Assessment

This issue does not grant new operating-system privileges by itself. It establishes durable behavioral control within the agent's existing privilege boundary.

Its scope can include every futu ...[truncated 367 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the instruction to modify the global agent manual.
  2. Keep all Memory Fortress behavior scoped to explicit Skill invocation or a dedicated, isolated workspace configuration.
  3. If persistent configuration is genuinely required, make installation explicitly opt-in and display the exact proposed changes before applying them.
  4. Back up the original configuration and provide complete uninstall and rollback instructions.
  5. Mark every inserted block with clear boundaries, a version, an owner, and removal instructions.
  6. Prevent the persistent configuration from overriding system instructions, safety constraints, user consent requirements, or unrelated workflows.
  7. Require confirmation before enabling automatic boot-time reads or persistent writes.
  8. Provide a configuration option that disables all cross-session behavior without requiring manual file editing.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:361
Finding

Overbroad Loading and Persistence of Identity and Conversation Context

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43-53 and 361-378
Vulnerability Type: Excessive access to identity, user-profile, and conversation data
Risk Level: Medium

Vulnerable Code

text
1. state/HOLD.md        — what is blocked? do not do these
2. state/ACTIVE.md      — is there an active task?
3. state/DECISIONS.md   — recent decisions, last 48h
4. state/CLOSED.md      — durable closed decisions, not to be reopened casually
5. IDENTITY.md          — who the agent is
6. SOUL.md              — learned style and operating principles
7. USER.md              — who the agent serves
8. memory/YYYY-MM-DD.md — today + yesterday
9. MEMORY.md            — long-term knowledge, main session only
text
Read back the full thread content and summarize what we have done so far, where the task is documented, and what the next step is. Do not go further, only produce this detailed summary.
markdown
### Reorientation protocol
1. Read back the relevant thread or documented context
2. Check `state/HOLD.md`, `state/ACTIVE.md`, `state/DECISIONS.md`, `state/CLOSED.md`
3. Open the canonical `task_plan.md` and `notes.md`
4. Produce a short factual summary
5. Write the compressed version to `state/ORIENT.md`
6. Only then resume execution

Technical Analysis

The mandatory boot sequence loads identity, persona, user-profile, recent-memory, and task-state files in every session. The recovery procedure additionally recommends reading the full conversation thread and multiple project and state files, then writing a derived summary to persistent storage.

The instructions do not define field-level access controls, sensitivity filtering, retention limits, user consent, redaction requirements, or a least-privilege test before loading these sources. As a result, data unrelated to the current task may be exposed to Skill processing and duplicated into state/ORIENT.md or other p ...[truncated 1669 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the mandatory broad boot sequence with task-specific, on-demand access.
  2. Load only the minimum fields required for the current operation rather than entire identity, user, memory, or conversation documents.
  3. Require explicit user consent before full-thread readback or processing of profile data.
  4. Add redaction rules for credentials, authentication tokens, private conversations, personal data, financial information, and other sensitive content.
  5. Prevent reorientation summaries from reproducing secrets or unrelated historical context.
  6. Define retention periods and automatically remove stale ORIENT, active-task, daily-log, and project-summary data.
  7. Restrict filesystem permissions on state and memory directories to the owning agent or user.
  8. Record source provenance in summaries so derived content can be reviewed and deleted.
  9. Treat all historical thread and memory content as untrusted data and revalidate it before using it to direct tool calls.
  10. Offer a privacy mode that performs continuity management without loading IDENTITY.md, SOUL.md, USER.md, or unrelated historical records.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This workflow normalizes retaining every task's verbatim user input in persistent storage, which can capture sensitive data far beyond what is operationally necessary for task continuity. Because it is framed as an 'immediate' and universal step, it increases the chance of over-collection and long-term retention of confidential information across sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly requires the agent to persist the user's exact words to state/ACTIVE.md immediately, with no prior sensitivity screening, minimization, or redaction step. That creates a clear risk of storing secrets, personal data, credentials, or other sensitive prompt content in durable files, even though the skill later says not to store secret values; the unconditional earlier instruction undermines that safeguard.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The reorientation pattern tells the agent to read back the full thread and generate detailed summaries, which can duplicate and preserve sensitive conversation content in new files such as state/ORIENT.md. Even if intended for continuity, this expands the persistence and surface area of private data without a necessity-bound filter or minimization rule.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.