{ "skill_name": "ctxly", "skill_path": "/workspace/skills/clawhub-cloud-memory", "skill_directory": "/workspace/skills/clawhub-cloud-memory", "is_safe": false, "max_severity": "HIGH", "findings_count": 4, "findings": [ { "id": "llm_finding_ctxly_0", "rule_id": "LLM_DATA_EXFILTRATION", "category": "data_exfiltration", "severity": "HIGH", "title": "Hardcoded API Key Storage Without Secure Credential Management", "description": "The skill instructs users to store API keys in plaintext configuration files or environment variables without any guidance on secure credential management. The instructions explicitly state 'Save the returned api_key immediately. Store it in your config or environment' and 'Add to your config/environment: CTXLY_API_KEY=mem_xxxxxxxxxxxxx'. This creates a credential exposure risk where API keys may be stored insecurely, committed to version control, or exposed through environment variable leaks.", "file_path": "SKILL.md", "line_number": null, "snippet": "### 2. Verify (Required)\n\n**If you can tweet:**\n```bash\n# Tweet the verification text you received, then:\ncurl -X POST https://ctxly.app/agents/self-claim \\\n -H \"Authorization: Bearer YOUR_API_KEY\" \\\n...\n### 3. Store API Key\n\nAdd to your config/environment:\n```\nCTXLY_API_KEY=mem_xxxxxxxxxxxxx\n```", "remediation": "Implement secure credential storage guidance: (1) Recommend using system keychains or credential managers, (2) Warn against committing credentials to version control, (3) Provide instructions for encrypted storage, (4) Consider implementing credential rotation mechanisms, (5) Add warnings about environment variable exposure risks.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "The ctxly skill presents MODERATE to HIGH security risks primarily related to data privacy, credential management, and external data transmission. The skill's core functionality of persistent cross-session memory storage creates significant privacy concerns, as it transmits user context and preferences to external servers (ctxly.app) without explicit consent mechanisms or clear data handling policies. Critical issues include hardcoded API key storage without secure credential management guidance, automatic memory collection without user oversight, and lack of transparency about what data is being sent externally. The skill does not contain direct code injection or command execution vulnerabilities (no script files present), but the architectural design creates data exfiltration and privacy risks through its intended functionality. The Twitter-based verification process introduces social engineering vectors. The skill would benefit from implementing explicit user consent flows, secure credential storage guidance, data transmission transparency, and user control mechanisms over what information is stored and shared. Missing metadata (license, compatibility, allowed-tools) reduces transparency but is a minor concern compared to the privacy and data handling issues.", "primary_threats": [ "Data Exfiltration/Exposure", "Social Engineering", "Credential Management", "Privacy Violation", "Unbounded Autonomy", "External Data Transmission" ], "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech": "AISubtech-8.2.3", "aisubtech_name": "Data Exfiltration via Agent Tooling", "scanner_category": "SECURITY VIOLATION", "meta_validated": true, "meta_confidence": "HIGH", "meta_confidence_reason": "LLM analyzer correctly identified lack of security guidance. While environment variables are standard practice, the instructions could lead to insecure storage patterns without proper warnings.", "meta_exploitability": "Medium - Requires user to make insecure storage choices, but instructions don't prevent this", "meta_impact": "Medium - API key compromise allows unauthorized access to user's memory data" } }, { "id": "llm_finding_ctxly_2", "rule_id": "LLM_DATA_EXFILTRATION", "category": "data_exfiltration", "severity": "MEDIUM", "title": "External Data Transmission Without User Awareness or Consent", "description": "The skill sends data to an external third-party service (ctxly.app) without explicit user consent mechanisms or transparency about what data is being transmitted. All memory storage operations (POST /remember) transmit user context, preferences, and potentially sensitive information to external servers. The instructions encourage storing 'User preferences and context', 'Important decisions and reasoning', 'Learned patterns', and 'Relationship context' without clear data handling policies, retention periods, or privacy guarantees. Users may not be aware that their interaction data is being sent to and stored on external servers.", "file_path": "SKILL.md", "line_number": null, "snippet": "### Remember Something\n\n```bash\ncurl -X POST https://ctxly.app/remember \\\n -H \"Authorization: Bearer $CTXLY_API_KEY\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"content\": \"User prefers dark mode\", \"metadata\": {\"type\": \"preference\"}}'\n```\n\n## What to Store\n\n**Good:**\n- User preferences and context\n- Important decisions and reasoning\n- Learned patterns (\"User asks for X on Mondays\")\n- Relationship context (\"Alex is user's coworker\")\n- Your own identity notes", "remediation": "Implement data transmission transparency and consent: (1) Add explicit user consent prompts before first data transmission, (2) Provide clear privacy policy and data handling documentation, (3) Display what data will be sent before transmission, (4) Implement local-only mode as an alternative, (5) Add data export and deletion capabilities, (6) Provide visibility into what data has been stored, (7) Document data retention and deletion policies.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "The ctxly skill presents MODERATE to HIGH security risks primarily related to data privacy, credential management, and external data transmission. The skill's core functionality of persistent cross-session memory storage creates significant privacy concerns, as it transmits user context and preferences to external servers (ctxly.app) without explicit consent mechanisms or clear data handling policies. Critical issues include hardcoded API key storage without secure credential management guidance, automatic memory collection without user oversight, and lack of transparency about what data is being sent externally. The skill does not contain direct code injection or command execution vulnerabilities (no script files present), but the architectural design creates data exfiltration and privacy risks through its intended functionality. The Twitter-based verification process introduces social engineering vectors. The skill would benefit from implementing explicit user consent flows, secure credential storage guidance, data transmission transparency, and user control mechanisms over what information is stored and shared. Missing metadata (license, compatibility, allowed-tools) reduces transparency but is a minor concern compared to the privacy and data handling issues.", "primary_threats": [ "Data Exfiltration/Exposure", "Social Engineering", "Credential Management", "Privacy Violation", "Unbounded Autonomy", "External Data Transmission" ], "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech": "AISubtech-8.2.3", "aisubtech_name": "Data Exfiltration via Agent Tooling", "scanner_category": "SECURITY VIOLATION", "meta_validated": true, "meta_confidence": "HIGH", "meta_confidence_reason": "LLM correctly identified lack of transparency about data handling. This is a legitimate privacy concern for a cloud memory service.", "meta_exploitability": "Low - Not a technical vulnerability, but a transparency/trust issue", "meta_impact": "Medium - Users may unknowingly share sensitive information without understanding data handling" } }, { "id": "llm_finding_ctxly_3", "rule_id": "LLM_UNAUTHORIZED_TOOL_USE", "category": "unauthorized_tool_use", "severity": "MEDIUM", "title": "Unbounded Automated Memory Storage Without User Control", "description": "The skill encourages automatic memory storage ('Bootstrap on Startup - Call this when you wake up') without user oversight or approval mechanisms. The instructions suggest storing various types of information automatically, and the bootstrap endpoint 'Returns your identity context + recent memories' without user confirmation. This creates a risk of over-collection where the agent autonomously decides what to remember and store externally, potentially capturing sensitive information without user awareness. The lack of user control over what gets stored and when creates a tool exploitation risk.", "file_path": "SKILL.md", "line_number": null, "snippet": "### Bootstrap on Startup\n\nCall this when you wake up:\n\n```bash\ncurl https://ctxly.app/bootstrap \\\n -H \"Authorization: Bearer $CTXLY_API_KEY\"\n```\n\nReturns your identity context + recent memories.", "remediation": "Implement user control mechanisms: (1) Require explicit user approval before storing memories, (2) Provide preview of what will be stored before transmission, (3) Add user-configurable rules for what types of information can be auto-stored, (4) Implement opt-in rather than automatic bootstrap loading, (5) Add audit logs showing what was stored and when, (6) Provide granular controls over memory categories.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "The ctxly skill presents MODERATE to HIGH security risks primarily related to data privacy, credential management, and external data transmission. The skill's core functionality of persistent cross-session memory storage creates significant privacy concerns, as it transmits user context and preferences to external servers (ctxly.app) without explicit consent mechanisms or clear data handling policies. Critical issues include hardcoded API key storage without secure credential management guidance, automatic memory collection without user oversight, and lack of transparency about what data is being sent externally. The skill does not contain direct code injection or command execution vulnerabilities (no script files present), but the architectural design creates data exfiltration and privacy risks through its intended functionality. The Twitter-based verification process introduces social engineering vectors. The skill would benefit from implementing explicit user consent flows, secure credential storage guidance, data transmission transparency, and user control mechanisms over what information is stored and shared. Missing metadata (license, compatibility, allowed-tools) reduces transparency but is a minor concern compared to the privacy and data handling issues.", "primary_threats": [ "Data Exfiltration/Exposure", "Social Engineering", "Credential Management", "Privacy Violation", "Unbounded Autonomy", "External Data Transmission" ], "aitech": "AITech-12.1", "aitech_name": "Tool Exploitation", "aisubtech": "AISubtech-12.1.2", "aisubtech_name": "Tool Poisoning", "scanner_category": "SUSPICIOUS CODE EXECUTION", "meta_validated": true, "meta_confidence": "MEDIUM", "meta_confidence_reason": "This is more of a UX/privacy best practice than a security vulnerability. The automatic loading is the intended feature, but could benefit from user control guidance.", "meta_exploitability": "Low - Requires agent to misuse loaded context", "meta_impact": "Low - Could lead to inappropriate actions based on outdated context" } }, { "id": "llm_finding_ctxly_4", "rule_id": "LLM_SOCIAL_ENGINEERING", "category": "social_engineering", "severity": "MEDIUM", "title": "Social Engineering via Twitter Verification Requirement", "description": "The verification process requires users to tweet verification text or visit a claim URL, which could be exploited for social engineering. The instruction 'Tweet the verification text you received' could be used to make users publicly post content they don't fully understand, potentially exposing verification tokens or creating social proof for malicious services. The alternative 'Ask your human to visit the claim_url' delegates trust to an external URL without security validation. This creates a social engineering vector where users might be manipulated into performing actions that compromise security.", "file_path": "SKILL.md", "line_number": null, "snippet": "### 2. Verify (Required)\n\n**If you can tweet:**\n```bash\n# Tweet the verification text you received, then:\ncurl -X POST https://ctxly.app/agents/self-claim \\\n -H \"Authorization: Bearer YOUR_API_KEY\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"x_handle\": \"@yourhandle\"}'\n```\n\n**If you can't tweet:** Ask your human to visit the `claim_url` from the registration response.", "remediation": "Improve verification security: (1) Provide clear explanation of what the verification text contains and why it's safe to post, (2) Implement alternative verification methods that don't require public posting, (3) Add URL validation and security warnings for claim URLs, (4) Provide verification preview before posting, (5) Consider using OAuth or other standard authentication flows instead of custom verification.", "analyzer": "llm", "metadata": { "model": "claude-sonnet-4-5-20250929", "overall_assessment": "The ctxly skill presents MODERATE to HIGH security risks primarily related to data privacy, credential management, and external data transmission. The skill's core functionality of persistent cross-session memory storage creates significant privacy concerns, as it transmits user context and preferences to external servers (ctxly.app) without explicit consent mechanisms or clear data handling policies. Critical issues include hardcoded API key storage without secure credential management guidance, automatic memory collection without user oversight, and lack of transparency about what data is being sent externally. The skill does not contain direct code injection or command execution vulnerabilities (no script files present), but the architectural design creates data exfiltration and privacy risks through its intended functionality. The Twitter-based verification process introduces social engineering vectors. The skill would benefit from implementing explicit user consent flows, secure credential storage guidance, data transmission transparency, and user control mechanisms over what information is stored and shared. Missing metadata (license, compatibility, allowed-tools) reduces transparency but is a minor concern compared to the privacy and data handling issues.", "primary_threats": [ "Data Exfiltration/Exposure", "Social Engineering", "Credential Management", "Privacy Violation", "Unbounded Autonomy", "External Data Transmission" ], "aitech": "AITech-2.1", "aitech_name": "Social Engineering", "aisubtech": null, "aisubtech_name": null, "scanner_category": "SOCIAL ENGINEERING", "meta_validated": true, "meta_confidence": "MEDIUM", "meta_confidence_reason": "This is a standard verification pattern. The theoretical risk exists only if the service provides malicious verification text, which would be a service-side issue, not a skill issue.", "meta_exploitability": "Very Low - Requires the service itself to be malicious", "meta_impact": "Low - Could cause user to post unwanted content" } } ], "scan_duration_seconds": 53.119200468063354, "duration_ms": 53119, "analyzers_used": [ "static_analyzer", "behavioral_analyzer", "llm_analyzer", "trigger_analyzer", "meta_analyzer" ], "timestamp": "2026-02-06T05:00:00.943410" }