ClawHub
Back to skill

Security audit

memos-skill

Security checks across malware telemetry and agentic risk

Overview

This Memos notes skill is coherent, but it asks an agent to keep and use a persistent account token while allowing deletes, bulk edits, uploads, and token creation without enough safety boundaries.

Install only if you want an agent to access your Memos account. Use a dedicated low-privilege or revocable token if available, keep config.json out of version control, avoid pasting real tokens into chat, and require explicit confirmation before deleting notes, bulk editing, uploading files, changing visibility, overwriting config, or creating new access tokens.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The skill explicitly documents creating personal access tokens via the API, which expands its scope from memo management into credential lifecycle management. That is security-sensitive because token creation can establish persistent API access and, if misused or exposed, can enable broader unauthorized actions than ordinary memo CRUD.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger description is overly broad and can activate on generic phrases like notes or memo-related language, increasing the chance the skill runs in contexts the user did not intend. Because this skill supports destructive and authenticated remote actions, accidental invocation raises the risk of unintended data modification or disclosure.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation instructs users to store an access token in a local config.json file without sufficient warning about plaintext credential storage. Tokens written to disk can be exposed through backups, logs, repository commits, or other local users/processes, leading to compromise of the Memos account or instance.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill documents update, delete, upload, and test-request flows that can modify remote state but does not require explicit safety prompts or user confirmation. In an agent setting, lack of friction around state-changing operations increases the risk of accidental destructive actions against the user's live Memos instance.

Ssd 3

Medium
Confidence
97% confidence
Finding
The examples instruct users to supply tokens in plain text and include patterns that may re-display or persist those secrets in configuration and output examples. This materially increases the chance of credential leakage through chat history, logs, screenshots, terminal output, or generated files.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:71