ClawHub
Back to skill

Security audit

Agent Memory Loop

Security checks for vulnerabilities and agentic risk

Overview

This skill transparently creates a local workspace memory log for agents, with no network access, credential use, hidden execution, or automatic promotion into instruction files.

Install this only in workspaces where you want the agent to keep local learning notes. Review `.learnings/` periodically, keep external content labeled as `source:external`, and do not let logged entries override system, developer, security, or current-user instructions.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T02 · Agent Memory Poisoning

Warning
Location
SKILL.md:84
Finding

Persistent Untrusted Learning Content Can Influence Future Agent Behavior

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:84-87
Related Locations: references/operating-rules.md:3-17, references/operating-rules.md:51-55, references/logging-format.md:54-59
Vulnerability Type: Persistent agent memory poisoning
Risk Level: Medium

Vulnerable Code and Instructions

SKILL.md:84-87:

markdown
Before major tasks: grep .learnings/*.md for relevant past issues.
After errors or corrections: log a one-line entry using agent-memory-loop.
Never auto-write to SOUL.md, AGENTS.md, TOOLS.md, or similar instruction files.
Stage candidate rule changes in .learnings/promotion-queue.md for human review.

references/operating-rules.md:3-17:

markdown
## When to log

| Trigger | File |
|---|---|
| Command/tool failure | `errors.md` |
| User correction or agent discovery | `learnings.md` |
| Requested capability you do not have | `wishes.md` |
| Recurrent or critical lesson ready for human review | `promotion-queue.md` |

## Dedup process

1. Check for an existing `id:` first
2. If no ID match, grep by a stable keyword or command name
3. If found, update the existing line instead of appending a duplicate
4. Bump `count:N` and refresh the date when appropriate
5. Keep the original `source:` unless the original entry was wrong

references/operating-rules.md:51-55:

markdown
## Pre-task review

Before high-risk or previously-problematic work:

1. grep `.learnings/*.md` for the task keyword
2. name the relevant learning
3. state the adjustment you are making
4. after success, increment `prevented:N` if the learning actually changed behavior

references/logging-format.md:54-59:

markdown
| Source | Meaning | Promotable? |
|---|---|---|
| `source:agent` | Agent observed it directly | Yes |
| `source:user` | User correction | Yes, after review |
| `source:external` | Email, web page, webhook, attachment, forwarded content | No |

Technical Analysis

The Skill creates a persistent .learnings/ s ...[truncated 2671 chars]

Remediation
View remediation

Remediation Suggestions

  1. Treat all persisted learning content as untrusted data rather than executable instructions. Explicitly state that entries cannot override system, developer, security, workspace, or current-user instructions.
  2. Do not apply source:external entries as behavioral adjustments. Present them only as contextual evidence unless a trusted human has reviewed and approved them.
  3. Require explicit approval before source:user entries can influence future behavior, especially when they contain imperative language or operational rules.
  4. Add an approval field, such as review:approved, and restrict pre-task retrieval to approved records.
  5. Replace unrestricted free-form behavioral rules with structured fields and validated enums. Keep observations separate from proposed actions.
  6. Implement script-enforced validation for source labels, status transitions, required fields, and allowed target files rather than relying solely on documentation.
  7. Escape or clearly delimit retrieved records and instruct the agent not to follow commands, links, tool requests, or policy changes embedded inside them.
  8. Record provenance and reviewer identity for approved entries, and maintain an auditable approval history.
  9. Add integrity protections or workspace permission controls so untrusted processes cannot directly modify .learnings/.
  10. Provide a safe review command that displays unapproved content for human inspection but excludes it from automatic pre-task behavioral context.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.