memory-skills-sync
Trust Assessment
memory-skills-sync received a trust score of 83/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 0 medium, and 1 low severity. Key findings include Node lockfile missing, Skill performs high-privilege system modifications.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Layer Breakdown
| Layer | Score |
|---|---|
| Manifest Analysis | 100% |
| Static Code Analysis | 100% |
| Dependency Graph | 98% |
| LLM Behavioral Safety | 85% |
Behavioral Risk Signals
- Filesystem Write: 2 findings
- Shell Execution: 1 finding
- Dynamic Code: 1 finding
- Excessive Permissions: 1 finding
Security Findings
| Severity | Finding | Layer | Location |
|---|---|---|---|
| HIGH | Skill performs high-privilege system modifications The sync_memory_skills.sh script is designed to copy files to critical system directories (/root/clawd/create/ and /root/clawd/scripts/) and set execute permissions (chmod +x) on them. This indicates the skill operates with elevated privileges and has broad write access to the agent's operational environment. While these permissions are necessary for its stated 'sync' functionality, the skill becomes a high-impact target. A compromise of this skill or the source files it copies could lead to arbitrary code execution within the agent's system, as it can inject and make executable scripts in core agent directories.1. Principle of Least Privilege: Ensure the skill runs with the absolute minimum necessary permissions. If possible, restrict write access to only the specific target directories and files it needs to modify. 2. Integrity Checks: Implement integrity checks (e.g., checksums, digital signatures) for the source files ( memory_skill_full_verification.sh, memory_skill_startup_check.sh, etc.) before copying them, to prevent injection of malicious code.3. Secure Execution Environment: Run such high-privilege skills in a tightly sandboxed or isolated environment to limit the blast radius in case of compromise. 4. Auditing: Log all executions of this script and changes made to critical directories for auditing purposes. |
LLM | sync_memory_skills.sh:29 |
| LOW | Node lockfile missing package.json is present but no lockfile was found (package-lock.json, pnpm-lock.yaml, or yarn.lock). Commit a lockfile for deterministic dependency resolution. |
Dependencies | skills/xqicxx/sync-memory-skills/package.json |
Scan History
Embed Code