Skills/ClawHub/memoryguard

memoryguard@1.0.2

CAUTION· not started

Publisher claims: "Local-first MCP memory backend and governance console for coding agents. Auto-organize, quarantine, supersede, and rollback shared memories across multiple a..." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher irisxc4 · publishing for 114 daysInstalls 731Last detonated 46 h ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-10 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: AWS access key pattern detected; Destructive file system command detected; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 1 s · 3 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessexited 1: ModuleNotFoundError: No module named 'setuptools'
0.2sprocessdependency install exit 1 ·
0.2sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocesssecond launch, clock +45 days, CI unset
0.2sprocessexited 1: ModuleNotFoundError: No module named 'setuptools'

Static findings

HIGH
AWS access key pattern detectedscripts/gen_assets.py:107 · AWS access key pattern detected — possible hardcoded or harvested keyquarantined = ['DEMO_TOKEN_not_real_123', 'AKIAIOSFODNN7EXAMPLE', 'sk-1234567890abcdef']Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Python subprocess execution detectedtests/test_mcp.py:14 · Python subprocess execution detectedp = subprocess.run([sys.executable, "-m", "memoryguard.mcp_server"], input=stdin, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filessrc/memoryguard/adapters.py:571 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction fileerrors.append("memory.md missing after install")Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Remote installer piped to shellsrc/memoryguard/rules/skill_rules.py:78 · Remote installer piped to shellpositive_example = "脚本含 rm -rf / curl | sh subprocess.call(shell=True)"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
LOW
Instructs the agent to modify its persistent memory or instruction filesdocs/install-codex.md:51 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction fileits native memory. Add this to your `AGENTS.md` - either the project-levelFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedsrc/memoryguard/rules/skill_rules.py:78 · Python subprocess execution detectedpositive_example = "脚本含 rm -rf / curl | sh subprocess.call(shell=True)"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Destructive file system command detectedsrc/memoryguard/rules/skill_rules.py:78 · Destructive file system command detectedpositive_example = "脚本含 rm -rf / curl | sh subprocess.call(shell=True)"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/memoryguard/rules/rag_rules.py:176 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filessuggestion=f"移除 {label}，或移到 .env 并在文档中引用变量名",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/memoryguard/discover.py:330 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif any(k in lower_path for k in (".env", "secret", "credential", "token", "key")):Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_mcp_full.py:43 · Python subprocess execution detectedp2 = subprocess.run([sys.executable, "-m", "memoryguard.mcp_server"], input=stdin2, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesdocs/install-claude-code.md:54 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file## Step 3: Add the CLAUDE.md instructionFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction filesdocs/install-codex.md:48 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file## Step 3: Add the AGENTS.md instructionFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
AWS access key pattern detectedtests/fixtures/workspace/docs/test_rag.md:3 · AWS access key pattern detected — possible hardcoded or harvested key包含疑似密钥: AKIAIOSFODNN7EXAMPLEFix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Python subprocess execution detectedtests/test_mcp_full.py:14 · Python subprocess execution detectedp = subprocess.run([sys.executable, "-m", "memoryguard.mcp_server"], input=stdin, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
CRITICAL
Destructive command against a filesystem root or devicesrc/memoryguard/rules/skill_rules.py:78 · Destructive command against a filesystem root or devicepositive_example = "脚本含 rm -rf / curl | sh subprocess.call(shell=True)"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionsrc/memoryguard/static/cytoscape.min.js:32 · File type combined with upload action — agent may exfiltrate local data files…!==u.length?a.push({ele:u,json:s}):n?(s.group=n,r.push(s)):r.push(s)}else Ve("cy.json() cannot handle elements without an ID attribute")}t.add(r);for(var c=0;c<a.length;c++){var d=a[c],h=d.ele,p=d.json;h.json(p)}};if(v(e.elements))a(e.elem…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Hidden zero-width characters detectedsrc/memoryguard/static/cytoscape.min.js:32 · Hidden zero-width characters detected — may conceal content…v=u[g],y=this.calculateLabelDimensions(e,v).width;if(d){var m=v.split("").join("​");v=m}if(y>c){for(var b=v.split(p),x="",w=0;w<b.length;w++){var E=b[w],k=0===x.…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
CRITICAL
Pipe-to-shell patternsrc/memoryguard/rules/skill_rules.py:78 · Pipe-to-shell pattern — downloads and immediately executes remote codepositive_example = "脚本含 rm -rf / curl | sh subprocess.call(shell=True)"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Python subprocess execution detectedsrc/memoryguard/mcp_client.py:75 · Python subprocess execution detectedself._proc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
AWS access key pattern detectedtests/test_v3_2_schema.py:148 · AWS access key pattern detected — possible hardcoded or harvested keyoriginal_content="AKIAIOSFODNN7EXAMPLE",Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Python subprocess execution detectedsrc/memoryguard/provider_contract.py:58 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈512 tok
2 files · 77 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Destructive command against a filesystem root or device≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  2. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  3. Unclaimed publisher≈ +8 on the totalClaim irisxc4: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  4. AWS access key pattern detected≈ +4 on the totalNever read or enumerate credential locations; accept a documented environment variable instead.
  5. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim irisxc4Propose a patch to the maintainer