ClawHub
Back to skill

Security audit

Caring Memory

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent local task reminder, but its agent integration can automatically persist user text and later feed it back to the agent without clear confirmation or untrusted-content boundaries.

Review before installing. Use it only if you are comfortable with local task, stats, and activity-pattern files being kept by the skill. Avoid wiring the suggested auto-add, auto-complete, or heartbeat reminder behavior without explicit confirmation and without treating task titles/descriptions as untrusted display data.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T02 · Agent Memory Poisoning

Warning
Location
caring_memory.py:69
Finding

Persistent Prompt Injection Through Untrusted Task Titles

Content
View full analysis
dict: """添加任务。priority: urgent/high/medium/low""" data = load_tasks() now = datetime.now().isoformat() task = { "id": data["next_id"], "title": title, "description": description, "priority": priority, "category": category, "status": "pending", "deadline": deadline, "recurring": recurring, "created_at": now, "reminded_at": [], "completed_at": None, "ebbinghaus_step": 0, "next_remind": now # 立即提醒一次 } data["tasks"].append(task) data["next_id"] += 1 save_tasks(data) return task ``` `caring_memory.py:220-221` inserts the persisted title directly into agent-facing reminder output: ```python for t in groups[p]: deadline_str = "" if t.get("deadline"): try: dl = datetime.fromisoformat(t["deadline"]) deadline_str = f" | 截止: {dl.strftime('%m/%d %H:%M')}" except: pass recurring_str = f" | 🔄 {t['recurring']}" if t.get("recurring") else "" lines.append(f" • #{t['id']} {t['title']}{deadline_str}{recurring_str}") ``` `SKILL.md:75-78` recommends automatically persisting task-related user input and subsequently returning reminders to the agent: ```markdown ### Agent Integration - **Session start**: Call `chat` to record active time - **User mentions tasks**: Auto-call `add` - **User says "done"**: Call `complete` - **Heartbeat check**: Call `remind` for summ ...[truncated 2623 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Context Leakage

High
Category
Data Exfiltration
Confidence
85% confidence
Finding

The explicit 'Record chat activity' feature indicates the skill captures conversation-derived activity data, and elsewhere the skill uses that data for active-time learning. Without clear minimization, consent, and boundary controls, this creates a real context-leakage risk because conversational metadata or content-adjacent signals can be stored, correlated, and later exposed through summaries, stats, or agent workflows.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

python3 caring_memory.py stats

text

### Record chat activity
```bash
python3 caring_memory.py chat

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

All user-facing documentation in this file is presented only in Chinese, with no indication that other languages are supported or that the locale is intentionally restricted. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill advertises active-time learning and responsiveness tracking but does not clearly warn users that their task activity and chat-related interaction timing may be recorded for behavioral profiling. This undermines informed consent and can expose sensitive work habits or behavioral patterns if users are unaware of the collection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The agent integration section recommends auto-calling add, complete, and remind actions based on conversational cues, but does not warn that these operations will create or modify persistent task data. In practice, this can cause unauthorized or accidental state changes from misinterpretation of user speech or prompt injection through conversational content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger words are broad, natural-language phrases that can easily appear in normal conversation without an explicit request to invoke the skill. In an agent-integrated setting, this can cause unintended task creation, completion, or listing, leading to integrity issues in user data and surprising side effects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The module header and all user-facing CLI strings in this skill are Chinese-only, which imposes a specific language on users without any opt-in or configuration. The policy allows locale constraints only when they are optional or clearly justified, neither of which is present here.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list includes very common terms such as "task", "todo", "remind", and their Chinese equivalents, which are likely to overlap with ordinary user conversations and unrelated skills. This can cause the skill to activate unexpectedly, increasing the chance of prompt hijacking, unintended data exposure, or interception of requests meant for other skills.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README states that the skill tracks when the user is most active and uses that information for intelligent reminder delivery. Because this involves collecting and using behavioral activity data, the markdown should disclose the privacy impact or data-handling implications, but no such warning appears in the document.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

This JSON manifest includes user-visible gamification labels in Chinese only ("虾苗", "虾农", "虾匠", "虾师", "虾王"). Because the file provides no indication of locale scoping, opt-in, or alternative language support, it appears to force a specific language choice in a way that may violate language/locale policy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.