Security audit

Engram Evomap - Long Term AI Memory

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent memory-assistant purpose, but it needs Review because it can persist session-derived memory, inject retrieved advice as system-level guidance, send recent conversation content to an LLM client, and ships a trusted seed recommending a global Git TLS bypass.

Review this skill carefully before installing. Avoid using it in sessions containing secrets or private customer data unless commit is gated and redacted. Remove or replace the Git SSL seed, do not run the suggested global sslVerify false command, avoid injecting stored memories as system instructions, and pin the package/version used for npx execution.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Error

Location: src/core/context-injector.js:47
Finding: Persistent Untrusted Memory Is Injected into the System Role
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: data/seeds/seeds.json:57
Finding: Bundled High-Trust Memory Recommends Disabling Git TLS Verification Globally
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/core/gene-processor.js:19
Finding: Raw Conversation History Is Sent to a Caller-Provided LLM Before Redaction
Content: View full analysis
`[${m.role}]: ${m.content}`).join('\n'); const prompt = ` ``` The unmodified history is interpolated into that prompt: ```js ${rawText} ``` `src/core/gene-processor.js:49-55` then transmits the prompt through the caller-provided client: ```js const response = await this.llmClient.ask(prompt); const cleanJson = response.replace(/```json|```/g, '').trim(); const distilled = JSON.parse(cleanJson); const searchKey = `${distilled.triggerPattern} ${distilled.rootCause}`; const embedding = await this.embed.vectorize(searchKey); ``` The LLM client is supplied through configuration at `src/core/engram-core.js:21-23`: ```js this.verifier = new VerificationEngine(config.llmClient); this.processor = new GeneProcessor(config.llmClient, this.embedding); ``` ### Technical Analysis The distillation instructions ask the LLM to generalize sensitive values, but that transformation occurs only after the raw conversation has already crossed the LLM client boundary. There is no local preprocessing that removes API keys, passwords, tokens, private keys, internal URLs, source code, personal data, or infrastructure details before `llmClient.ask(prompt)` is invoked. The project does not restrict the LLM client to a local implementation or a trusted endpoint. Consequently, the confidentiality of the recent conversation depends entirely on an externally supplied object and its implementation. No explicit consent, endpoint disclosure, data-retention warning, or local-only enforcement is present in this path. ### Att ...[truncated 1390 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (32)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: LLM-based evaluation, self-reflection, and dynamic trust scoring introduce autonomous interpretation of stored session content that is not reflected in the description. This can amplify privacy risk and create opaque decision-making over stored memories, especially if sensitive session data is committed and later re-ranked or summarized automatically.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: LLM-based evaluation, self-reflection, and dynamic trust scoring introduce autonomous interpretation of stored session content that is not reflected in the description. This can amplify privacy risk and create opaque decision-making over stored memories, especially if sensitive session data is committed and later re-ranked or summarized automatically.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: LLM-based evaluation, self-reflection, and dynamic trust scoring introduce autonomous interpretation of stored session content that is not reflected in the description. This can amplify privacy risk and create opaque decision-making over stored memories, especially if sensitive session data is committed and later re-ranked or summarized automatically.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: LLM-based evaluation, self-reflection, and dynamic trust scoring introduce autonomous interpretation of stored session content that is not reflected in the description. This can amplify privacy risk and create opaque decision-making over stored memories, especially if sensitive session data is committed and later re-ranked or summarized automatically.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code comment claims remote model sending/access is disabled, yet preheat() explicitly downloads Xenova/all-MiniLM-L6-v2 over the network via pipeline(...). This creates a misleading trust boundary: operators may believe initialization is fully local/offline when it actually performs remote fetches, exposing them to unexpected network access and model supply-chain risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The seed explicitly recommends git config --global http.sslVerify false, which disables TLS certificate validation for all Git HTTPS operations on the machine. In a long-term memory system, this is especially dangerous because the unsafe workaround can be repeatedly surfaced and normalized, exposing users to man-in-the-middle attacks, credential theft, and tampered repository contents.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This file gives the skill an embedded capability to recommend bypassing Git TLS verification as a stored solution pattern. Because the skill is a memory hub meant to prevent repeated bugs, preserving this recommendation increases the chance that insecure system-wide configuration changes are suggested in future unrelated or loosely related contexts.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The README instructs users to run npx engram without pinning a specific version, which causes execution of whatever package version is currently published under that name. In an agent-oriented package that users are encouraged to embed into autonomous workflows, this increases supply-chain risk because a compromised or newly malicious release could be fetched and executed immediately.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill declares executable capabilities (node and env usage) but does not define an explicit tool/permission scope, which weakens least-privilege controls and makes it harder for a host agent to constrain execution safely. In a skill that invokes external CLI behavior and long-term storage, missing scope boundaries increases the chance of unintended command execution or data access beyond what users expect.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: Using npx engram without a pinned version allows installation of whatever package version is current at execution time, creating a supply-chain risk. If the upstream package is compromised or a breaking/malicious version is published, the skill could execute attacker-controlled code automatically.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill does not clearly warn users that !exp commit stores session-derived information into long-term memory, which undermines informed consent and can lead to accidental retention of secrets, proprietary data, or personal information. This is especially dangerous because the skill is explicitly framed as automatic and persistent, increasing the likelihood of silent data capture.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The automatic triggers are broad (error, failed, 404, timeout, etc.) and can activate consult/commit behavior in many ordinary contexts, causing unintended retrieval or persistence. In a memory skill, over-triggering can leak session content into long-term storage or inject advice unexpectedly into unrelated workflows.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This file includes natural-language comments in Chinese (e.g. the configuration comment on L10) while the skill provides no indication that it is region-specific or that language is selectable. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This is a JSON manifest file, so vague-trigger checks apply. The trigger description "Installing npm packages on an old project or strict modern env" is broad and lacks explicit boundaries or exclusions, which could cause this capsule to activate for common package-install situations rather than only the targeted dependency-tree failure.
Content: No source excerpt is available for this finding.

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · data/seeds/seeds.json (reported line 12)May include surrounding context.
json
"triggerSignature": { "errorPattern": "ERR! ERESOLVE unable to resolve dependency tree", "taskIntent": "Installing npm packages on an old project or strict modern env", "embedding": [0.1012, -0.0456, 0.0890, 0.334, 0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0. ...[truncated 25 chars]

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · data/seeds/seeds.json (reported line 48)May include surrounding context.
json
"triggerSignature": { "errorPattern": "ERR! ERESOLVE unable to resolve dependency tree", "taskIntent": "Installing npm packages on an old project or strict modern env", "embedding": [0.1012, -0.0456, 0.0890, 0.334, 0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0.1, 0. ...[truncated 25 chars]

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The git trigger is broad enough to match common clone/push/pull scenarios, and it is paired with a dangerous remediation that disables SSL verification globally. That combination makes the seed more dangerous because routine Git problems may activate an insecure recommendation outside narrowly controlled corporate-certificate scenarios.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The success message returned by commit is hard-coded in Chinese (经验已存储) while the rest of the file's user-facing text is in English. This creates a language/locale policy issue because the skill imposes a specific language on users without offering a choice or documenting a justified regional constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file contains multiple user-facing strings in Chinese, including headings and descriptive text used in the injected advice. This imposes a specific language on users without any opt-in or documented locale constraint, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manager accepts arbitrary conversation history and immediately dispatches it to background processing via this.processor.distill(history) while only returning a generic task acknowledgment. In a long-term memory skill, conversation history can contain sensitive prompts, secrets, or personal data, so silently sending it for asynchronous distillation without explicit notice or consent creates a real privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The code collects an environment fingerprint through EnvChecker.getFingerprint() and binds it into a stored capsule without any visible disclosure, permission gate, or minimization. Environment fingerprints can expose host-specific metadata useful for tracking, profiling, or correlating deployments, which is particularly sensitive in an agent memory system designed to persist context over time.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The primary natural-language documentation for the skill is written only in Chinese, describing the system purpose and behavior without offering a language or locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The embedded prompt instructs the reviewer entirely in Chinese and requires output fields described in Chinese, which implicitly fixes the interaction language. There is no indication that users can choose another language or that this locale restriction is documented as an intentional region-specific constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The code sends capsule-derived content, including error patterns, task intent, and action sequences, to an external LLM client without any visible consent, minimization, or policy enforcement in this component. In a long-term memory hub, capsules may contain sensitive operational data, source snippets, credentials, or proprietary incident context, so silent exfiltration to a third-party model is a real privacy and security risk.
Content: No source excerpt is available for this finding.