Engram Evomap - Long Term AI Memory

• Outcome: Review
• Latest audit: May 29, 2026 · 9:22 PM UTC
• Version: 0.1.0

Overview

This is a coherent long-term memory skill, but it needs Review because it can persist session history, route distilled content through a configured LLM, auto-inject advice, and includes a high-trust seed recommending globally disabling Git SSL verification.

Install only if you are comfortable with an agent memory tool that stores troubleshooting context across sessions and may process recent conversation history through the configured LLM. Review or remove the bundled Git SSL seed before use, and avoid enabling auto-commit for sessions containing secrets, private code, credentials, customer data, or sensitive operational details.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares no required environment permissions, yet the metadata indicates environment-related capability use. That mismatch weakens reviewability and consent because operators cannot accurately assess what host data the skill may access or expose, especially in a memory-oriented skill that may persist context.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose materially understates the skill's apparent behavior: model downloading, LLM-based distillation/scoring, system-history injection, and environment fingerprint capture/storage. This is dangerous because users and reviewers may approve a 'memory hub' without realizing it performs network retrieval, stores potentially sensitive session data, and can influence future agent behavior through injected advice.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The comment claims remote model sending is disabled, but the code still fetches a model from a remote source during initialization. This can mislead users and reviewers about network behavior, weakening trust boundaries and creating supply-chain exposure if the remote model source is tampered with or unexpectedly contacted in restricted environments.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This seed stores and recommends `git config --global http.sslVerify false`, which disables certificate validation for all future Git HTTPS operations on the host. That creates a persistent man-in-the-middle exposure and is especially dangerous in a long-term memory system because the unsafe workaround can be repeatedly suggested and normalized beyond the original context.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The capsule encodes an unjustified security-bypass capability for a memory hub by recommending global SSL verification disablement. Because this is durable seed data intended to influence future agent actions, it increases the chance that insecure network behavior is applied automatically in unrelated repositories and sessions.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README explicitly advertises automatic interception and injection of '[EvoMap Advice]' into agent behavior when certain error signals are detected, but it does not clearly warn users that the skill can autonomously modify outputs or decision flow. In an agent skill context, undisclosed runtime intervention increases the risk of unexpected actions, unsafe suggestions, or hidden prompt-channel influence, especially when users are told to directly embed SKILL.md into agent instructions.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The automatic trigger rules are broad enough to fire on common words like 'error', '404', or 'timeout', which can cause unintended consultation and context injection. In a skill that retrieves and inserts memory advice, over-triggering increases the risk of prompt contamination, irrelevant guidance, or accidental handling/storage of sensitive troubleshooting context.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill states that successful complex tasks should be auto-committed to long-term memory, but the description does not clearly warn that session content may be stored externally. This creates a real risk of unconsented retention of sensitive prompts, outputs, operational details, or credentials encountered during successful workflows.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The instruction directly tells the user to disable Git SSL verification globally without a prominent inline warning, making a high-risk action look like a routine fix. In operational use, agents or users may execute it immediately, undermining transport authenticity and enabling interception of credentials or source code.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code immediately launches background processing on full conversation history and the returned user message indicates the data will be distilled, stored, and later reflected on by an LLM, but there is no evidence of explicit consent, minimization, retention controls, or a way to opt out. In a long-term memory skill, this increases the chance that sensitive prompts, credentials, personal data, or proprietary content are persisted and sent through additional model-processing steps without sufficiently clear notice or control.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code sends the last 12 conversation turns, including raw user and assistant content, to an external LLM via `llmClient.ask(prompt)` without any visible consent, minimization beyond truncation, or redaction of sensitive content from the conversation itself. Because session history can contain secrets, personal data, internal paths, URLs, or proprietary debugging details, this creates a real confidentiality and privacy risk if users are unaware or if the downstream provider stores or logs prompts.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code sends derived troubleshooting content (`triggerPattern` and `rootCause`) to an embedding service using `this.embed.vectorize(searchKey)` without any visible notice or sensitivity review. Even though this is derived data rather than the full transcript, it can still expose proprietary incident patterns, internal system behavior, or user-related problem descriptions to an external service.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code sends capsule-derived content directly to an external LLM via llmClient.ask(prompt) without any visible consent, disclosure, minimization, or redaction step. Because the capsule appears to represent long-term memory and prior task context, this can expose sensitive operational, code, or user-derived data to a third-party model service, creating a privacy and data-governance risk.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.