ClawHub
Back to skill

Security audit

Memory Distiller

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent, but it silently saves broad conversation-derived memories that can affect future sessions, so users should review it before installing.

Install only if you deliberately want automatic persistent memory. Review `MEMORY.md`, `USER.md`, and dated memory files regularly, avoid sharing sensitive information while the skill is active, and prefer a pinned or otherwise verified ClawHub installer version instead of `@latest`.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:156
Finding

Unpinned npm Package Execution Through Mutable Latest Version

Content
View full analysis

Vulnerability Details

File Locations:

  • SKILL.md:156-160
  • README.md:12-16
  • README.md:41-45
  • README_CN.md:13-17
  • README_CN.md:41-45

Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippets:

SKILL.md:156-160:

bash
## Installation

```bash
npx clawhub@latest install memory-distiller
text

`README.md:12-16`:
```bash
## Installation

```bash
npx clawhub@latest install memory-distiller
text

`README.md:41-45`:
```bash
Install both for maximum effect:

```bash
npx clawhub@latest install proactive-agent
npx clawhub@latest install memory-distiller
text

`README_CN.md:13-17`:
```bash
```bash
npx clawhub@latest install memory-distiller
text

`README_CN.md:41-45`:
```bash
```bash
npx clawhub@latest install proactive-agent
npx clawhub@latest install memory-distiller
text

### Technical Analysis

The documented installation procedure invokes `npx` with the mutable `@latest` version selector. `npx` can download and execute npm packages, including package lifecycle or command-entry scripts, with the permissions of the user running the command.

Because `@latest` is not tied to an exact reviewed package version or integrity digest, the effective code executed during installation can change after this Skill has been audited. Neither the downloaded `clawhub` package nor the optional `proactive-agent` package is included in the reviewed project, so their implementation and future releases cannot be verified from the audited files.

This creates a supply-chain exposure: compromise of the package publisher, npm account, registry resolution process, or a future release could cause users following the documentation to execute altered code.

### Attack Path

1. An attacker compromises the npm publisher account, publication pipeline, or another component controlling the package selected by the `latest` 
...[truncated 1116 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with an exact, reviewed package version, for example:
    bash
    npx clawhub@1.2.3 install memory-distiller
  2. Review the selected package release and its transitive dependencies before recommending it.
  3. Pin dependency integrity using a lockfile, cryptographic digest, trusted artifact mechanism, or registry integrity verification where supported.
  4. Document the expected npm registry and avoid allowing untrusted registry overrides during installation.
  5. Apply the same version-pinning and verification controls to the optional proactive-agent installation.
  6. Consider instructing users to download and inspect the package before execution rather than combining retrieval and execution in one command.
  7. Run installation with the least-privileged account necessary and without unnecessary credentials in the environment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The README advertises automatic scanning of every conversation and writing structured entries to persistent memory, but it does not prominently warn users about privacy, retention, or the possibility that sensitive data may be stored long-term. Because the skill’s core function is durable memory extraction, the missing disclosure materially increases the risk of unnoticed collection of personal, confidential, or regulated information.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README states that conversation corrections, preferences, and insights are automatically written to a persistent memory file, but it does not clearly warn users about privacy, retention, or the possibility that sensitive content from chats may be stored long-term. In the context of a subconscious-style agent memory skill, that omission is especially dangerous because users may disclose secrets, personal data, or proprietary information without realizing it will persist beyond the session.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill advertises automatic writing of conversation-derived content into persistent memory files, but does not present a clear, upfront user warning about silent persistence. This is dangerous because users may disclose corrections, preferences, or incidental sensitive details without realizing they are being durably stored and reused later.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The auto-trigger phrases are broad, common conversational terms like 'actually', 'wrong', and 'got it', which can easily appear in ordinary discussion. In this skill's context, those phrases can silently trigger persistence logic and cause unintended extraction and storage of user content into long-term memory files.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The behavior rules explicitly instruct the agent to perform silent auto-triggered memory writes and avoid notifying the user. In a skill dedicated to durable memory, this substantially increases privacy and integrity risk because data-affecting actions occur without awareness, review, or consent.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The README instructs users to run npx clawhub@latest install memory-distiller, which fetches and executes the latest published package rather than a pinned, audited version. This creates a supply-chain risk: if the package or a dependency is compromised, users may execute attacker-controlled code during installation without noticing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases (wrong, actually, I prefer, remember this, etc.) are broad and commonly occur in normal conversation, so the skill may activate on incidental text rather than deliberate memory-saving requests. In the context of an automatic persistent-memory tool, this can cause over-collection, incorrect memory formation, and retention of sensitive or misleading statements.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

This installation example again uses npx clawhub@latest, causing execution of whatever version is current at install time. Repeating the unpinned command increases exposure because users are encouraged to normalize unsafe installation behavior across related skills.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

Although this line references installation of the target skill, it is part of the same npx clawhub@latest execution flow and therefore carries the same remote-code-execution/supply-chain risk. In a README, such commands are especially dangerous because users commonly copy-paste them directly into a shell.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The README instructs users to install and run npx clawhub@latest, which fetches and executes the latest package version rather than a pinned, reviewed release. This creates a supply-chain risk: a compromised upstream package or malicious new release could execute arbitrary code during installation or skill setup.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrases include common conversational language such as corrections, preferences, and generic expressions like 'Actually...' or '以后用', making activation boundaries broad and ambiguous. In a memory-writing skill, this can cause unintended capture and persistence of incidental statements, increasing the chance of poisoning memory, storing sensitive data, or altering future agent behavior based on casual remarks.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

This example again uses npx clawhub@latest, causing users to execute whatever package version is current at runtime. In security-sensitive agent tooling, unpinned remote execution materially increases the risk of supply-chain compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The second install command in the combined example also references npx clawhub@latest, repeating the same unpinned execution pattern. Because the tool installs agent skills, compromise here could affect both the local environment and future agent behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manual trigger list includes vague phrases such as 'note that' and 'save this', which are likely to occur in normal requests without the user intending durable storage. Because the skill writes to persistent memory, ambiguous activation can lead to accidental retention of sensitive or misleading information.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The installation command uses npx clawhub@latest, which fetches and executes the newest published package at install time rather than a reviewed, fixed version. This creates a supply-chain risk: if the package is compromised or a breaking/malicious update is published, users may execute untrusted code during installation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.