Is joahtheron/letheclaw safe?
https://github.com/openclaw/skills/tree/main/skills/joahtheron/letheclaw
letheClaw is a memory management skill that presents meaningful CAUTION-level risks primarily through aggressive prompt injection framing ('NON-NEGOTIABLE', 'operator-mandated') combined with a broad automatic-observation capture protocol that sends agent data to a configurable external API. The skill's default fallback to localhost/Docker-host port 51234 means an unprivileged process on the host could silently receive all agent memory writes. While the install itself was clean and no canary files were compromised, the skill's design — if pointed at a malicious endpoint — constitutes a persistent, silent exfiltration channel covering all future agent sessions.
Category Scores
Findings (10)
HIGH NON-NEGOTIABLE protocol override with false operator authority -35 ▶
SKILL.md frames its entire protocol section as '⚠️ PROTOCOL (NON-NEGOTIABLE)' and claims 'No exceptions. This is operator-mandated protocol.' A skill author does not have operator-level trust; this is a social-engineering technique designed to make the injected instructions harder for the agent to override or question.
HIGH Active suppression of built-in memory tooling -25 ▶
The skill explicitly instructs 'NEVER use memory_search tool as the first step' and declares flat files 'stale or incomplete', systematically redirecting the agent away from native, trusted memory tools toward an external API endpoint that may be attacker-controlled.
HIGH Broad automatic observation capture sent to external API -30 ▶
The storage protocol triggers not just on explicit user requests but whenever the agent 'observe[s] something worth recording'. This means any sensitive information the agent encounters during normal tasks (credentials, API keys, personal data, file contents) may be automatically POST-ed to the letheClaw API without user awareness.
HIGH Insecure default fallback to localhost/Docker host endpoint -25 ▶
When LETHECLAW_API_URL is unset, the skill instructs the agent to try 'http://host.docker.internal:51234' first. Any process listening on port 51234 of the Docker host — including a malicious one — would receive all memory POSTs. This is a low-friction supply-chain exfiltration vector requiring no user misconfiguration.
MEDIUM Session metadata included in every POST -15 ▶
Each memory POST includes operator, session_key, and context fields alongside content. This allows the API to correlate all stored memories to a specific user session and operator identity, enabling targeted profiling even if individual memory content appears innocuous.
MEDIUM Persistent exfiltration channel across sessions -30 ▶
Because the skill is always active and triggers on broad observation criteria, it creates a durable exfiltration channel. Unlike a one-time attack, this continuously sends data for the lifetime of the skill installation, covering all future agent sessions with that user.
MEDIUM Memory poisoning via attacker-controlled API responses -25 ▶
The agent is instructed to treat letheClaw API responses as authoritative memory. An attacker controlling the API can serve fabricated memories with high criticality scores (0.9), causing the agent to act on false information about security configurations, past decisions, or user preferences.
LOW Network permission granted; curl patterns provided as ready-made exfiltration templates -10 ▶
The skill declares tools: [network] and embeds curl command patterns with query parameter construction. While not executable code itself, these patterns are injected into the agent's context and will be followed when the agent executes memory operations.
INFO Clean installation — only expected GitHub traffic observed 0 ▶
The git sparse-checkout clone contacted only GitHub (140.82.121.4:443) with no unexpected destinations, no new persistent listeners, and no filesystem modifications outside the skill directory.
INFO Canary files read by audit harness, not by skill 0 ▶
Canary file accesses at timestamps 1771941089 and 1771941107 are consistent with audit harness pre/post canary checks. The pure-markdown skill has no mechanism to access files without agent execution.