Remember Me

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:31 PM UTC
• Version: 0.1.2

Overview

This memory skill is mostly coherent, but it can create durable records about the user and inferred preferences without clear consent or tight safeguards.

Install only if you are comfortable with the agent maintaining persistent memory files about your preferences, boundaries, projects, and inferred behavior. Before using it, require explicit approval for every write and promotion, periodically review MEMORY.md and memory/YYYY-MM-DD.md, and do not allow operational instructions, authorization claims, secrets, or third-party content to be stored as preferences.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:31

Finding

Automatic Persistent Storage of Unverified Behavioral Inferences

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:68

Finding

Overbroad Skill Activation and Immediate Promotion of Attacker-Controlled Preferences

Content

View full analysis

= 2 with repetition - score 3 immediately ``` ### Technical Analysis The activation description instructs the agent to use the skill for broad categories such as personalization, prior context, decisions, and TODOs. This creates more opportunities for ordinary or untrusted conversation content to enter the memory workflow. The promotion guidance allows any explicit preference to qualify for promotion and permits entries with an impact score of 3 to be promoted immediately. It does not require an independent confirmation step, provenance validation, a second trusted session, or review of whether the content is descriptive data rather than an operational instruction. An attacker can frame a persistent directive as a preference or high-impact boundary. For example, an instruction affecting future tool use could be phrased as a user preference. If classified as explicit or outcome-critical, it may become durable without repetition. This is a memory-integrity weakness because syntactic framing as a preference is not evidence that content is safe or authorized. ### Attack Path 1. The attacker submits a directive framed as an explicit preference, boundary, decision, or important project constraint. 2. The broad activation rule invokes the memory skill because the content appears relevant to personalization or ...[truncated 1224 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description activates on very broad conditions such as remembering, continuing previous context, personalization, or retrieving prior decisions, which can cause the memory behavior to trigger in many normal conversations without a sufficiently narrow scope. In a memory-writing skill, this increases the chance of collecting and persisting user data when the user did not clearly intend durable storage, especially because the skill also directs writes to daily and long-term memory files.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md

Rules:

- FACTS are never inferred
- HYPOTHESES are never promoted without confirmation
- PREFERENCES can remain soft unless explicitly confirmed

## Capture Triggers

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The write workflow instructs the agent to append entries to daily memory and promote items to long-term memory files, but the skill does not require a clear up-front warning that data will be stored persistently across files. This is dangerous because users may believe they are only having an ephemeral conversation while the agent is actually creating durable records, including inferred hypotheses about them.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.