ClawHub
Back to skill

Security audit

Autobiographical Memory

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed local memory skill that stores and recalls user context, with privacy considerations but no evidence of hidden, deceptive, or unrelated behavior.

Install only if you want the agent to keep local long-term memory about you, your projects, preferences, and past conversations. Avoid storing secrets or highly sensitive personal details, and periodically inspect or delete MEMORY.md and memory/*.md entries you no longer want retained.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs the agent to persist user-related preferences, conversations, decisions, and identity changes across sessions and to delete or modify entries later, but it does not require explicit user consent, retention disclosure, or review controls. This creates privacy and integrity risks: sensitive personal data may be stored longer than the user expects, and memories may be altered or removed without transparency.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The guidance instructs the agent to write updated content into MEMORY.md, which is persistent user-related data, without requiring user awareness, confirmation, or clear policy checks before modifying stored memory. In a memory-management skill, silent persistence or alteration of personal information can lead to privacy violations, inaccurate long-term profiling, and hard-to-detect corruption of future agent behavior based on stale or mistaken memories.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.