T09 · Insecure Skill Coding Practices
Error
- Location
scripts/search.sh:18- Finding
Arbitrary Python Code Execution Through Search Query Injection
- Content
View full analysis
- Remediation
View remediation
Security audit
secure-memory-stack
Security checks for vulnerabilities and agentic risk
Overview
This memory skill has useful, purpose-related features, but its privacy claims and several scripts are too broad or unsafe for automatic trust.
Review this skill before installing. Do not rely on the zero-upload or offline claims if Baidu Embedding is enabled, avoid storing secrets or regulated data until data flows are documented, and do not run the permission repair, cleanup, verification, or external-script refresh paths in a shared /root/clawd workspace without auditing and scoping them first.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (7)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/fix.sh:26- Finding
Recursive Permission Widening Across the Entire Workspace
- Content
View full analysis
/dev/null || true echo "✅ 文件权限已修复" ;; ``` `WORKSPACE` is defined as: ```bash WORKSPACE="/root/clawd" ``` ### Technical Analysis The repair command recursively assigns mode `755` to every file and directory under `/root/clawd`. This is not restricted to files owned by the Skill. It makes regular files broadly readable and executable by other local users and processes. The subsequent `chmod -R 644` only addresses two memory files and does not restore safe permissions for unrelated credentials, configuration files, databases, or private artifacts under the workspace. ### Attack Path 1. A user or automated process invokes `secure-memory fix permissions` or `secure-memory fix all`. 2. The command recursively changes permissions on all content under `/root/clawd`. 3. Unrelated files that were previously private become readable by other local security principals. 4. Other users or compromised processes inspect the newly exposed files for secrets and sensitive memory data. ### Impact Assessment The operation violates least privilege and crosses the Skill’s component boundary. It can expose: - Memory and session contents. - API configuration and credentials stored in workspace files. - Private data belonging to unrelated Skills. - Executable scripts and operational configuration. - Any other sensitive artifact located below `/root/clawd`. It may also cause reliability problems by marking non-executable data files as executable. ]]>- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
memory_maintenance.sh:12- Finding
Unscoped Cleanup Deletes Files Belonging to Unrelated Components
- Content
View full analysis
/dev/null || true find /root/clawd -name "*.temp" -type f -delete 2>/dev/null || true echo "✅ 临时文件清理完成" ;; ``` ### Technical Analysis The cleanup operation recursively searches the shared `/root/clawd` workspace and deletes every regular file ending in `.tmp` or `.temp`. It does not verify ownership, age, purpose, current use, or whether a file belongs to this Skill. Temporary filename extensions do not establish that deletion is safe. Other Skills or active applications may use such files for transactions, locks, recovery state, or intermediate output. ### Attack Path 1. An unrelated component creates or uses a `.tmp` or `.temp` file under `/root/clawd`. 2. A user invokes the memory maintenance cleanup action. 3. The unrestricted `find` commands traverse the entire workspace. 4. The unrelated file is deleted without confirmation or recovery support. 5. The owning component loses state, fails, or produces corrupted output. ### Impact Assessment The vulnerability can cause data loss and denial of service across components sharing the workspace. The Skill can delete files outside its declared memory-management scope, including active temporary state maintained by unrelated tools. ]]>- Remediation
View remediation
T07 · Tool Hijacking and Spoofing
Error
- Location
scripts/secure-memory.sh:33- Finding
Execution of Unverified Scripts Located Outside the Skill Package
- Content
View full analysis
" exit 1 fi echo "🔍 使用分层搜索策略搜索: $QUERY" bash "/root/clawd/hierarchical_memory_search.sh" "$QUERY" ;; ``` ```bash "refresh") echo "🔄 记忆系统刷新..." # 运行最高效能引导 /root/clawd/memory_bootstrap.sh ;; ``` ```bash if [ -f "/root/clawd/memory_bootstrap.sh" ]; then echo "🚀 运行记忆系统引导脚本..." /root/clawd/memory_bootstrap.sh fi ``` ### Technical Analysis The Skill executes scripts from the shared workspace rather than from its reviewed package directory. These files are not included as verified package dependencies, and the code performs no ownership, permission, signature, or integrity checks before execution. The existence check in the model-change loader only confirms that a path is a file. It does not establish that the file is trusted. A replaced file, unsafe symbolic link, or workspace-controlled script can therefore become an execution primitive behind a legitimate Skill command. ### Attack Path 1. An attacker or compromised local component creates or replaces `/root/clawd/hierarchical_memory_search.sh` or `/root/clawd/memory_bootstrap.sh`. 2. The attacker places arbitrary shell commands in that file. 3. A user invokes hierarchical search or refresh, or model-change processing runs the loader. 4. The Skill executes the attacker-controlled file. 5. The payload inherits the Skill process privileges, environment variables, and workspace access. ### Impact Assessment Successful exploitation permits arbitrary shell command execution. The payload may access persistent m ...[truncated 197 chars]- Remediation
View remediation
other
Error
- Location
SKILL.md:15- Finding
Local-Only Privacy Claims Conflict with External Baidu API Processing
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
package.json:23- Finding
Core Memory Dependencies Use Mutable Versions Without Integrity Locking
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/memory_skill_full_verification.sh:95- Finding
Verification Hook Permanently Modifies the Memory Database
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (93)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documentation makes strong privacy and security claims such as '完全本地化', '零上传', and '离线可用', but elsewhere instructs users to configure Baidu Embedding API credentials for semantic search. If semantic search sends memory content or queries to Baidu, users may disclose sensitive data under a false assumption of offline-only operation. In a memory system intended to store personal or security-relevant notes, this mismatch is especially dangerous because users are likely to entrust high-sensitivity data to it.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The document contains contradictory privacy assurances: it promises fully offline, zero-upload operation while also presenting Baidu Embedding API integration as part of the system. Contradictory trust messaging in security-sensitive documentation can cause operators to deploy the skill under incorrect assumptions, exposing private notes, credentials, or internal records to third-party processing. Because this is a 'secure memory' skill, inaccurate privacy claims directly affect user threat modeling and safe use.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The security section states there is '无网络传输' and that the system is '完全离线使用', yet the same document says semantic search uses Baidu Cloud Embedding-V1. This contradiction can mislead users into believing no external transmission occurs, when in practice cloud embedding likely requires sending text-derived data off-device. For a privacy-focused memory product, misleading deployment and data-flow claims materially increase confidentiality risk.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Although the command targets a specific directory, documenting a raw 'rm -rf' deletion command encourages copy-paste execution of a destructive operation. In the context of a local memory/privacy skill, this is more dangerous because users may erase stored memories, configuration, or adjacent data if the path is modified or misunderstood.
- Content
bash # 删除skill目录 rm -rf /root/clawd/skills/secure-memory-stack # 如果通过ClawdHub安装 clawdhub uninstall secure-memory-stack
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Although the command targets a specific directory, documenting a raw 'rm -rf' deletion command encourages copy-paste execution of a destructive operation. In the context of a local memory/privacy skill, this is more dangerous because users may erase stored memories, configuration, or adjacent data if the path is modified or misunderstood.
- Content
bash # 删除skill目录 rm -rf /root/clawd/skills/secure-memory-stack # 如果通过ClawdHub安装 clawdhub uninstall secure-memory-stack
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The guide states that all data is stored locally and that there is no risk of external data leakage, yet earlier sections require Baidu Embedding API access and network connectivity. This creates a misleading security claim that could cause operators to send sensitive memory contents to a third-party service under the false assumption that the system is fully local.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The security section claims there is no external data leakage risk while the same document describes dependence on an external Baidu API. Such contradictory security documentation can lead users to store confidential information in the memory system without understanding that data may leave the local environment for embedding generation or related API interactions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill claims security/privacy protections and Git Notes/Baidu integration that are reportedly not implemented, while still performing scaffold and repository setup. False security assurances are dangerous because users may store sensitive information believing controls exist when they do not.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill claims security/privacy protections and Git Notes/Baidu integration that are reportedly not implemented, while still performing scaffold and repository setup. False security assurances are dangerous because users may store sensitive information believing controls exist when they do not.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill claims security/privacy protections and Git Notes/Baidu integration that are reportedly not implemented, while still performing scaffold and repository setup. False security assurances are dangerous because users may store sensitive information believing controls exist when they do not.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The skill claims security/privacy protections and Git Notes/Baidu integration that are reportedly not implemented, while still performing scaffold and repository setup. False security assurances are dangerous because users may store sensitive information believing controls exist when they do not.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill claims security/privacy protections and Git Notes/Baidu integration that are reportedly not implemented, while still performing scaffold and repository setup. False security assurances are dangerous because users may store sensitive information believing controls exist when they do not.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill claims security/privacy protections and Git Notes/Baidu integration that are reportedly not implemented, while still performing scaffold and repository setup. False security assurances are dangerous because users may store sensitive information believing controls exist when they do not.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill claims security/privacy protections and Git Notes/Baidu integration that are reportedly not implemented, while still performing scaffold and repository setup. False security assurances are dangerous because users may store sensitive information believing controls exist when they do not.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The skill claims security/privacy protections and Git Notes/Baidu integration that are reportedly not implemented, while still performing scaffold and repository setup. False security assurances are dangerous because users may store sensitive information believing controls exist when they do not.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill claims security/privacy protections and Git Notes/Baidu integration that are reportedly not implemented, while still performing scaffold and repository setup. False security assurances are dangerous because users may store sensitive information believing controls exist when they do not.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documentation promotes semantic search and zero upload without warning that embedding-based search may require sending user content externally. This omission undermines informed consent and is especially severe because the skill's domain is long-term memory, which often contains sensitive personal or operational data.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documentation states both 'fully local / zero upload' and use of Baidu Embedding API, which inherently requires sending data to an external service. In a privacy-focused memory skill, this contradiction can cause users to expose highly sensitive notes, preferences, or session data under false privacy expectations.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The security section promises local-only storage and no external transmission, but the same document instructs users to configure and troubleshoot an external Baidu API. Misrepresenting data-flow guarantees in a memory system is dangerous because it directly affects consent and handling of potentially confidential information.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README makes strong privacy and security claims such as '绝不上传', '无需网络连接即可使用全部功能', and '零数据泄露风险', while also advertising Baidu Embedding-based semantic search. If semantic search can rely on a third-party API, user memory content or queries may be transmitted off-device, making the privacy claims materially misleading and creating risk of unintended disclosure of sensitive data.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The document states that all data is stored locally and that there is no risk of external data leakage, yet earlier sections require Baidu Embedding API access for semantic processing. This is a materially misleading security claim because user content or derived text may be transmitted to a third-party service, causing operators to handle sensitive memory data under false privacy assumptions.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script asserts '网络传输: 无 (完全离线)' and '隐私保护: 最高级别' even though it checks for Baidu API credentials earlier and instantiates the Baidu embedding component, which strongly suggests dependence on an external service. This can mislead users into believing the system never uses networked third-party processing, creating a privacy and trust issue in a skill explicitly marketed as secure and local.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The changelog heading and descriptive text are written in Chinese, and the file provides no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The changelog simultaneously claims integration with a Baidu Embedding semantic search layer and also asserts 'zero data upload' and 'no network transmission'. For a security/privacy-focused memory system, this contradiction can mislead users into believing data never leaves the device when API-backed embedding generation may require remote transmission, creating privacy and trust risks.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file documents both 'local storage, no network transmission' and a 'Baidu Embedding API integration wizard', which is an active contradiction in a security-sensitive feature description. Users may configure the system under false assumptions about data residency, potentially exposing sensitive memory contents or metadata to a third-party service.
- Content
Static analysis
No suspicious patterns detected.