Security audit

Agent Memory Architecture

Security checks for vulnerabilities and agentic risk

Overview

This is a file-based agent memory guide whose persistence and local markdown storage are central to its stated purpose, with privacy caveats users should still treat seriously.

Install only if you want an agent to keep local markdown memory. Do not store credentials, regulated personal data, private keys, financial identifiers, or sensitive business details unless the memory directory is protected and excluded from sync or source control.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README promotes persistent memory commands such as '/remember [fact]' and a file-based recall system, but it does not clearly warn users that prompts, facts, or other potentially sensitive data may be written to local markdown files. This can lead users to store secrets, personal data, or proprietary information in plaintext on disk without realizing the retention and exposure risk, especially in shared machines, synced folders, or source-controlled directories.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The manifest description says the architecture uses no external tools, implying operation through plain files alone. However, the documentation later instructs use of a 'memory_search tool' and 'memory_get' for core search/retrieval workflows, which materially expands the described implementation beyond purely file-based practices.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The introductory documentation explicitly frames the skill as operating solely through files without external dependencies. Later sections contradict that intent by making 'memory_search' and 'memory_get' part of the documented search strategy, creating a direct documentation-to-documentation contradiction about how the system actually works.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill repeatedly instructs agents to persist user, agent, project, people, and conversation-derived context into local files, including when a human says 'remember this,' without requiring explicit notice, consent, retention limits beyond operational guidance, or minimization rules for personal data. In practice, this can lead to silent collection and retention of sensitive personal or business information in plain text, increasing the risk of privacy violations, unintended disclosure, and over-collection.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:494