Memory Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:08 AM UTC
• Version: 1.0.0

Overview

This memory setup skill is coherent, but its recommended default can index past chats and memory files through a third-party embedding provider without enough privacy guidance.

Before installing or following this skill, use a local provider or limit sources to curated memory unless you explicitly want past chat transcripts embedded. Review MEMORY.md, memory files, and sessions for secrets, credentials, private conversations, regulated data, or business-sensitive material before indexing.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:17

Finding

Session Transcripts Sent to a Third-Party Embedding Provider Without Privacy Safeguards

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17–24
Vulnerability Type: External processing of potentially sensitive session data through an insecure default configuration
Risk Level: Medium

Vulnerable Code Snippet:

json

{
  "memorySearch": {
    "enabled": true,
    "provider": "voyage",
    "sources": ["memory", "sessions"],
    "indexMode": "hot",
    "minScore": 0.3,
    "maxResults": 20
  }
}

The associated provider documentation at lines 123–129 confirms that Voyage is an API-backed provider:

markdown

### Provider errors?
- Voyage: Set `VOYAGE_API_KEY` in environment
- OpenAI: Set `OPENAI_API_KEY` in environment
- Use `local` provider if no API keys available

Technical Analysis

The recommended configuration enables real-time indexing of both persistent memory and historical session transcripts while selecting Voyage, an external embedding provider. As a result, transcript content may cross the local trust boundary for embedding generation.

Session transcripts can contain personal information, credentials, authentication tokens, proprietary material, internal decisions, or other confidential data. The Skill does not require explicit consent before enabling remote transcript processing, identify the data transmitted, require secret redaction, limit which sessions are indexed, or establish retention and access-control requirements. Although a local provider is mentioned as an alternative, it is not the recommended privacy-preserving default.

This issue does not grant operating-system privileges or execute arbitrary code. It creates a confidentiality and data-governance risk affecting any content included in the configured sessions and memory sources.

Attack Path

1. A user copies the recommended configuration into clawdbot.json or moltbot.json.
2. The memory subsystem enables hot indexing with sources set to both memory and `sessi ...[truncated 1070 chars]

Remediation

View remediation

Remediation Suggestions

1. Use a privacy-preserving default configuration:

   json

   {
     "memorySearch": {
       "enabled": true,
       "provider": "local",
       "sources": ["memory"],
       "indexMode": "hot",
       "minScore": 0.3,
       "maxResults": 20
     }
   }
   

2. Require explicit, informed opt-in before enabling the sessions source with any remote provider.

3. Clearly document which data is transmitted, the destination provider, applicable retention behavior, and relevant access controls.

4. Add secret detection and redaction for credentials, tokens, private keys, personal data, and other sensitive values before remote embedding requests.

5. Permit users to select specific sessions, directories, or data classes rather than indexing all available transcript history.

6. Recommend least-retention settings and provide procedures to remove indexed data from both local indexes and remote systems where supported.

7. Warn users not to place credentials or highly sensitive information in indexed memory files or sessions.

8. Retain remote providers as optional configurations for users who have reviewed and accepted the associated privacy and compliance implications.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly recommends indexing both long-term memory files and past conversation transcripts, but it does not warn that these sources may contain sensitive personal, organizational, or secret material. This can lead users to enable broad retention and retrieval of private data without informed consent or scoping, increasing the chance of over-collection, unintended disclosure, or policy noncompliance.

Content

No source excerpt is available for this finding.