ClawHub
Back to skill

Security audit

Remembering Conversations

Security checks for vulnerabilities and agentic risk

Overview

This memory skill is purpose-aligned, but it can search and read sensitive past conversation history too broadly without clear user consent or scoping.

Install only if you are comfortable with the agent searching archived conversations during some general coding-advice workflows. Prefer using it with explicit prompts, current-project limits, snippet-first reads, and care around past sessions that may contain credentials, private code, or sensitive tool output.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:11
Finding

Overbroad Access to Archived Conversation History

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:11-28, SKILL.md:32-48, MCP-TOOLS.md:5-14, and MCP-TOOLS.md:82-112
Vulnerability Type: Excessive access to stored conversation data
Risk Level: Medium

Vulnerable Code

SKILL.md:11-28

markdown
## Mandatory: Use the Search Agent

**YOU MUST dispatch the search-conversations agent for any historical search.**

Announce: "Dispatching search agent to find [topic]."

Then use the Task tool with `subagent_type: "search-conversations"`:

Task tool: description: "Search past conversations for [topic]" prompt: "Search for [specific query or topic]. Focus on [what you're looking for - e.g., decisions, patterns, gotchas, code examples]." subagent_type: "search-conversations"

text

The agent will:
1. Search with the `search` tool
2. Read top 2-5 results with the `show` tool
3. Synthesize findings (200-1000 words)
4. Return actionable insights + sources

SKILL.md:32-48

markdown
## When to Use

You often get value out of consulting your episodic memory once you understand what you're being asked. Search memory in these situations:

**After understanding the task:**
- User asks "how should I..." or "what's the best approach..."
- You've explored current codebase and need to make architectural decisions
- User asks for implementation approach after describing what they want

**When you're stuck:**
- You've investigated a problem and can't find the solution
- Facing a complex problem without obvious solution in current code
- Need to follow an unfamiliar workflow or process

**When historical signals are present:**
- User says "last time", "before", "we discussed", "you implemented"
- User asks "why did we...", "what was the reason..."
- User says "do you remember...", "what do we know about..."

MCP-TOOLS.md:82-112

markdown
## read

Display a full conv
...[truncated 3523 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require explicit, informed user consent before every search of archived conversations.
  2. Limit searches to the authenticated user and current project by default.
  3. Replace broad triggers such as ordinary architectural questions with explicit requests to consult conversation history.
  4. Return result metadata and minimal snippets first rather than immediately reading multiple conversations.
  5. Require a second authorization decision before reading a complete conversation.
  6. Use startLine and endLine to retrieve only the lines necessary for the current task.
  7. Apply automatic redaction for credentials, API tokens, personal data, and unrelated proprietary content.
  8. Enforce access controls in the episodic-memory service rather than relying exclusively on Skill instructions.
  9. Record archive searches and reads in an audit log containing the requesting user, project scope, query, accessed records, and justification.
  10. Prevent retrieved content from being reproduced verbatim unless it is necessary, authorized, and relevant to the current request.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The documentation explicitly states that full conversation content, tool uses/results, and absolute file paths may be displayed, but it provides no warning, consent gate, or sensitivity guidance. In an episodic-memory skill, historical conversations are especially likely to contain confidential code, credentials, internal paths, or prior tool outputs, so silent disclosure increases privacy and data-leak risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documented read tool accepts an arbitrary absolute path and will display the referenced JSONL file, which expands the skill from scoped memory lookup into generalized local file reading. In a memory-search context, this is dangerous because a model or prompt-injected conversation could be induced to open sensitive local archives or other JSONL files and expose their contents, especially since the response includes full conversation data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill description contains broad trigger phrases like 'how should I...' and 'what's the best approach...' that are common in normal user requests and not tightly scoped to explicit memory-retrieval needs. This can cause unintended invocation of the skill, leading the agent to search historical conversations when it may be unnecessary, increasing the chance of over-collection or disclosure of prior-context data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill is framed as searching past conversations, but the documented read capability retrieves full conversation bodies, including tool uses and results. This broadens data exposure beyond what a user may reasonably expect from 'searching history' and can reveal secrets, prompts, tokens, filesystem locations, or outputs captured in prior sessions.

Content

No source excerpt is available for this finding.