ClawHub
Back to skill

Security audit

Memory Cache

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to use Redis as a disclosed cache or shared state store, with low-level dependency hygiene concerns but no evidence of hidden, destructive, or deceptive behavior.

Install only if you are comfortable configuring Redis yourself. Use a Redis instance with authentication, TLS, restricted network access, and reasonable TTLs, and do not cache secrets, tokens, private prompts, or sensitive customer data unless that Redis environment is approved for it. Pin or update the Python dependencies before production use.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Low
Confidence
92% confidence
Finding
The skill explicitly instructs users to connect to Redis through REDIS_URL and to store agent state, cached API results, and shared sub-agent data, but it does not warn that this data may be sent to a remote Redis instance or may include sensitive information. In an agent environment, users may cache secrets, prompts, tokens, or session context, so missing disclosure and handling guidance increases the risk of unintended data exposure, especially when REDIS_URL points to externally hosted infrastructure.

Unpinned Dependencies

Low
Category
Supply Chain
Content
redis>=5.0.0
python-dotenv>=1.0.0
Confidence
93% confidence
Finding
The dependency is specified with a lower-bound range instead of an exact version, which makes builds non-reproducible and can pull in unexpected upstream releases. This increases supply-chain risk because a future compromised or breaking version could be installed without review.

Unpinned Dependencies

Low
Category
Supply Chain
Content
redis>=5.0.0
python-dotenv>=1.0.0
Confidence
95% confidence
Finding
The package is not pinned to a single exact version, so installations may resolve to different releases over time. That weakens reproducibility and can expose the skill to unreviewed or malicious upstream changes in the dependency supply chain.

Known Vulnerable Dependency: python-dotenv==1.0.0 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low
Category
Supply Chain
Confidence
88% confidence
Finding
The finding indicates that python-dotenv 1.0.0 has an advisory for symlink-following behavior in set_key that can allow arbitrary file overwrite under certain usage patterns. Even though this requirements entry is written as >=1.0.0 rather than ==1.0.0, the vulnerable version remains allowed by the specifier, so environments may install an affected release unless a safer minimum is enforced.

Static analysis

No suspicious patterns detected.