ClawHub
Back to skill

Security audit

Sharpagent Memory System

Security checks across malware telemetry and agentic risk

Overview

This is a coherent memory skill, but it asks the agent to keep and mutate long-term memory with broad automatic retention and unclear user controls.

Install only if you intentionally want durable agent memory. Before using it, decide what data it may store, where the memory files live, how to inspect/export/purge them, and disable or confirm scheduled dream processing unless you are comfortable with automatic memory changes.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The phrase "clean up" is an ambiguous natural-language trigger for dream processing, which includes archiving and forgetting operations. In a memory-management skill, broad triggers can cause unintended state-changing actions from casual user phrasing, leading to accidental deletion, migration, or consolidation of stored data without clear user intent.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill describes persistent multi-layer memory, archiving, and forgetting behavior but does not clearly warn users that their data may be retained across sessions, migrated between stores, soft-deleted, or preserved in audit/archive layers. This lack of disclosure creates privacy and consent risks, especially because users may assume conversational data is ephemeral when the system is explicitly designed for long-term retention.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.