ClawHub

Memory Enhancer

Security checks across malware telemetry and agentic risk

Overview

This skill does what it claims, but it automatically sends private daily logs to a model agent and stores personal details in long-term memory without enough user control.

Install only if you intentionally want daily private logs analyzed by an external model agent and merged into long-term memory. Before enabling cron, review the hard-coded paths, confirm which provider/model will receive the data, add a manual review or diff step before memory writes, and avoid logging full model results or raw error stacks.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill explicitly sends daily log content to OpenRouter for analysis but does not warn users that potentially sensitive personal data from memory files will be transmitted to a third-party service. Because this runs automatically via cron and maintains long-term memory, users may be unaware of ongoing external disclosure of private information such as contacts, habits, preferences, and project details.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill reads potentially sensitive daily log content from local memory and sends it wholesale to an external model session. Because the content may include personal preferences, contacts, habits, and project details, this creates a privacy and data-exposure risk, especially since there is no consent gate, minimization, redaction, or trust boundary enforcement before transmission.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal