T08 · Insecure Dependencies
Warning
- Location
SKILL.md:33- Finding
Unpinned Third-Party Packages Permit Supply-Chain Payload Changes
- Content
View full analysis
- Remediation
View remediation
Security audit
M2Wise
Security checks for vulnerabilities and agentic risk
Overview
This is a legitimate memory skill, but it needs Review because it encourages automatic long-term storage and reuse of personal user data without enough consent, scoping, or safety controls.
Install only if you are comfortable with an agent storing and reusing conversation-derived facts, preferences, and inferred guidance across sessions. Before using it with real users, require explicit opt-in, block secrets and sensitive categories from storage, pin dependency versions, protect API keys, add authentication around any API/MCP exposure, and provide clear review, export, and deletion controls for both memories and derived wisdom.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T02 · Agent Memory Poisoning
Error
- Location
EXAMPLES.md:155- Finding
Conversation-Derived Instructions Can Persistently Influence Future Agent Behavior
- Content
View full analysis
- Remediation
View remediation
other
Warning
- Location
SKILL.md:93- Finding
Proactive Collection and Retention of Personal Conversation Data Without Documented Consent Controls
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (20)
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md | `engine.sleep()` | Generate wisdom drafts | | `engine.dream()` | Verify and publish wisdom | | `engine.list_wisdom()` | List all wisdom | | `engine.forget()` | Delete memory or wisdom | ---
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md | `engine.sleep()` | Generate wisdom drafts | | `engine.dream()` | Verify and publish wisdom | | `engine.list_wisdom()` | List all wisdom | | `engine.forget()` | Delete memory or wisdom | ---
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md | `engine.sleep()` | Generate wisdom drafts | | `engine.dream()` | Verify and publish wisdom | | `engine.list_wisdom()` | List all wisdom | | `engine.forget()` | Delete memory or wisdom | ---
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill’s core purpose is to extract and persist user facts, preferences, and commitments as long-term memory, but it gives no warning about retention, downstream processing, or consent. In a conversational agent context, this can silently collect sensitive personal data and create privacy, compliance, and trust risks far beyond the immediate session.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill instructs the agent to proactively invoke memory storage whenever a user expresses a preference, shares a personal fact, or asks for memory-related behavior, without requiring a privacy disclosure first. This makes silent profiling more likely and increases the chance that sensitive attributes are stored automatically without informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The example explicitly stores a password-like secret in long-term memory and then retrieves it, which normalizes retention of highly sensitive credentials without any warning, redaction guidance, or safeguards. In a memory system for AI agents, this can lead developers to persist secrets in embeddings, indexes, logs, or downstream context, increasing exposure risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The FastAPI example exposes memory and wisdom records through simple endpoints without showing authentication, authorization, tenant isolation, or privacy warnings. In the context of an agent memory product, this could easily be copied into real deployments and result in unauthorized access to users' stored conversation-derived data.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly tells the agent to store user-provided personal facts and preferences into long-term memory as part of normal operation. In this skill’s context, that materially increases the danger because the entire design is centered on persistent cross-session profiling, making overcollection and retention misuse more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The example code directly stores a user message containing a personal preference in persistent memory, normalizing automatic retention as a default workflow. Because the example omits disclosure, minimization, and deletion controls, implementers may replicate unsafe behavior in production.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Persisting and automatically applying a language preference in future interactions can cause the agent to override the user’s current context or intent, especially if the preference was inferred once and never reconfirmed. While less severe than raw privacy leakage, it can still lead to autonomy and consent issues by enforcing behavior across sessions without fresh confirmation.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The best-practices section encourages saving strong user preferences even when the user did not ask for them to be remembered, which promotes silent persistence by default. This is dangerous because it operationalizes covert data retention as recommended behavior, increasing privacy harm and user surprise.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The skill recommends installing via
npx clawdhub@latest install m2wise, which executes an unpinned package version at runtime. This creates a supply-chain risk: a future compromised or malicious release of the installer could execute arbitrary code on the host when the skill is installed.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This is a markdown file, so SQP-2 applies to omitted warnings in the skill description. The
forget()API is explicitly destructive, but the reference only says 'Delete memory or wisdom' and does not warn that the action may be irreversible or affect stored user data.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document describes extracting user preferences, facts, commitments, and explicit requests from conversations and storing them as long-term memory with identifiers, timestamps, tags, and embeddings, but it does not mention user notice, consent, minimization, or handling of sensitive personal data. In a memory skill, this omission is risky because it encourages persistent collection of potentially sensitive profile data by default, creating privacy, compliance, and abuse risks if deployed unchanged.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The extraction prompt is hardcoded in Chinese without documenting any user preference, locale negotiation, or justification. In a subsystem intended to extract durable memories, forcing a single language can cause mis-extraction, biased behavior, or silent processing mismatches for non-Chinese users, which may lead to inaccurate persistence of user data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This section explicitly models persistent collection and storage of user identifiers, preferences, facts, evidence, and behavioral signals, but provides no privacy boundaries, consent requirements, retention limits, or access controls. In a memory subsystem for AI agents, that omission can lead to over-collection and unsafe long-term profiling of users, especially because the stored data includes personal preferences and inferred behavioral patterns.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The MCP tools example stores the preference "I prefer Chinese responses" as a default-style sample without indicating that language choice should come from the user. This can conflict with language/locale policy expectations when examples normalize forcing a specific language absent explicit opt-in context.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This is a markdown file, so missing-warning review applies. The example invokes
engine.dream(user_id="alice")to 'Verify and publish wisdom', but the surrounding documentation does not disclose what publishing does, whether it changes persisted state, or whether it may affect future behavior based on user data.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
In markdown, destructive capabilities should be disclosed when they can affect user data or system integrity.
engine.forget()is described only as 'Delete memory or wisdom' with no warning about permanence, scope, or recovery, which may leave users unaware of the impact.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The example encodes a preference for Chinese answers in a way that could be interpreted as forcing a language choice based on inferred conditions rather than explicit user selection at response time. The file does not clarify that language selection should be user-chosen or otherwise explicitly opted into.
- Content
Static analysis
No suspicious patterns detected.