Security audit

Clawhub Memory Engine

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed memory plugin, but it stores essentially every conversation persistently and adds background behavior without enough scoping, consent, retention, or disable guidance.

Install only if you intentionally want always-on long-term memory across conversations. Before running setup, review the external plugin and setup script, confirm where data is stored, how to pause or remove hooks and crons, how to delete/export memories, whether cross-agent sharing is disabled, and whether sensitive topics should be excluded.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger conditions are broad enough to activate the memory skill during many ordinary interactions involving user facts, recall, or quality checks. In a skill that persistently stores conversation data, overbroad triggering increases the chance of unnecessary collection, retention, and later retrieval of sensitive information beyond user expectations.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill advertises passive auto-capture of every conversation without presenting a clear privacy notice, consent mechanism, or retention limits. This creates a real risk of silently storing sensitive personal, medical, financial, or confidential data and can violate user expectations, organizational policy, or privacy regulations.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The example referencing a skin condition demonstrates use of potentially sensitive medical information without any warning, minimization guidance, or safeguards. In context, this normalizes storing and searching health-related data in persistent memory, which is especially risky because medical data is highly sensitive and often subject to stricter handling requirements.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The skill description promises that the agent 'remembers everything automatically,' which directs indiscriminate retention of user conversation content, including potentially sensitive data. In a persistent-memory skill, this is dangerous because it encourages blanket collection without necessity, consent, or data minimization, increasing exposure in case of misuse, leakage, or overbroad retrieval.

Ssd 3

High

Confidence: 98% confidence
Finding: The hooks are described as passively capturing every conversation by default, including both user messages and agent replies, making silent persistence a core behavior. This materially increases privacy and security risk because confidential content may be stored automatically even when unrelated to memory tasks, and the passive design reduces opportunities for informed user choice.

Ssd 3

High

Confidence: 98% confidence
Finding: The explicit hook definitions normalize automatic capture of all inbound and outbound messages, establishing indiscriminate logging as the intended default. This is particularly dangerous in this skill context because the captured data is not merely transient telemetry but part of a persistent searchable memory system, amplifying privacy harm and the blast radius of any compromise or misuse.

Static analysis

No suspicious patterns detected.