Memory System

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:24 AM UTC
• Version: 1.0.0

Overview

This skill is openly a memory and Obsidian sync pipeline, but it stores and processes sensitive personal and financial data too broadly and relies on external scripts that are not bundled for review.

Install only if you intentionally want an automatic, persistent memory system that can summarize financial records and sync them into an Obsidian vault. Before use, require explicit approval for each data source and sync destination, inspect or pin the referenced scripts, keep sensitive outputs out of general agent memory where possible, and make backups before enabling pruning.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:15

Finding

Untrusted conversation content can poison persistent agent memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15-28 and 101-109
Vulnerability Type: Persistent memory poisoning through automatic ingestion
Risk Level: High

Relevant source excerpt translated into English:

text

1. WAL (write-ahead log) - record in real time during the session
   Trigger:
   | When the user says...                 | Write to section |
   |---------------------------------------|------------------|
   | Amount/refund/payment method          | Accounting       |
   | "Use X"/"It is decided"               | Decisions        |
   | "Not X, but Y"                        | Decisions        |
   | "I like"/"I do not like"              | Decisions        |
   | cron/configuration/script changes     | System           |
   | Work that must continue another day   | To-do            |

2. MEMORY.md - long-term lesson index
3. memory/YYYY-MM-DD.md - daily raw archive
4. Obsidian - permanent archive

The later archival procedure promotes conclusions and lessons into MEMORY.md, SESSION-STATE.md, daily logs, and the task board.

Technical Analysis

The Skill treats conversational phrases as automatic persistence triggers. It does not require owner confirmation, validate the origin of a statement, distinguish data from instructions, or apply a restrictive schema before storing content.

This creates a persistent trust-boundary failure. Content supplied by an untrusted participant can be framed as a correction, preference, decision, lesson, configuration change, or future task. Once written into the WAL and promoted into long-term memory, it may be loaded by future sessions and treated as trusted historical context.

The append-only requirement further complicates recovery because poisoned entries may remain available even after later corrections.

Attack Path

1. An attacker participates in or influences a conversation processed by the Skill.
2. The attacker sub ...[truncated 990 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit authenticated owner approval before promoting conversation content into persistent memory.
• Separate factual records, preferences, tasks, and executable instructions into strictly validated schemas.
• Never persist shell commands, configuration directives, or behavioral instructions from untrusted conversation content.
• Store provenance with every entry, including author, session, timestamp, source, and approval status.
• Mark unverified entries as untrusted and prevent them from influencing tool execution.
• Add review, expiration, deletion, and rollback controls for all persistent entries.
• Perform semantic deduplication and conflict detection instead of relying only on text matching with grep.
• Keep an integrity-protected audit log of memory additions, modifications, approvals, and removals.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:64

Finding

Sensitive financial and personal data is consolidated in plaintext without documented protection controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 64-99 and 111-116
Vulnerability Type: Insecure storage and processing of sensitive data
Risk Level: Medium

Relevant source excerpt translated into English:

text

| Purpose             | Path                                      |
|---------------------|-------------------------------------------|
| WAL                 | {{workspace}}/memory/SESSION-STATE.md     |
| Long-term memory    | {{workspace}}/MEMORY.md                   |
| Daily log           | {{workspace}}/memory/YYYY-MM-DD.md        |
| Task board          | {{workspace}}/memory/taskboard.md         |
| Financial analysis  | {{workspace}}/memory/money.md             |
| Accounting CSV      | {{accounting_dir}}/2026-*.csv             |
| Asset snapshots     | {{vault}}/[asset snapshot directory]/     |
| Obsidian vault      | {{vault}}                                 |
| Synchronization     | {{sync_script}}                           |

money.md structure:
- Asset net worth
- Spending trends
- Weekly asset changes
- Pending tasks
- Key signals
- Diary relationships

Constraints:
- New data must be appended rather than overwritten.
- Do not store image files; register OCR content item by item as text.

Technical Analysis

The workflow aggregates accounting CSV files, asset snapshots, payment information, tasks, preferences, diary records, and receipt-derived OCR text into Markdown files and a permanent Obsidian archive.

The Skill does not specify encryption at rest, restrictive file permissions, field-level redaction, secret detection, access separation, synchronization safeguards, retention limits, or secure deletion. Transforming receipt images into searchable plaintext can increase exposure because account identifiers, transaction details, names, and balances become easy to index, copy, back up, and synchronize.

Cross-linking diary records, receipts, as ...[truncated 1286 chars]

Remediation

View remediation

Remediation Suggestions

• Encrypt sensitive memory, accounting, and vault data at rest using keys stored outside the workspace.
• Apply restrictive owner-only permissions to all generated files and directories.
• Redact account numbers, payment identifiers, names, addresses, and other unnecessary fields before persistence.
• Require explicit opt-in for each financial source and synchronization destination.
• Add destination allowlisting and transport-encryption requirements for synchronization.
• Define retention periods and implement secure deletion rather than unconditional permanent archival.
• Avoid persisting full OCR output; extract only necessary fields and discard sensitive source text.
• Separate financial records from general agent memory and prevent automatic inclusion in prompts.
• Add secret and personally identifiable information scanning before files are written or synchronized.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:34

Finding

Scheduled workflow executes unbundled and integrity-unverified external scripts

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 34-40 and 53-76
Vulnerability Type: Unsafe execution of externally mutable scripts
Risk Level: High

Relevant source excerpt translated into English:

bash

# 05:00 morning processing
# Read yesterday's log, extract lessons, and write them to MEMORY.md.
{{workspace}}/memory/scripts/memcore_evening.sh

# 22:00 evening processing
bash {{workspace}}/memory/scripts/memcore_evening.sh

# 23:30 Obsidian synchronization
obsidian-sync

The data-source table also defines the synchronization executable as the user-configurable path {{sync_script}}.

Technical Analysis

The audited package contains only SKILL.md and skill.json; it does not contain the referenced MemCore or synchronization scripts. Their implementation therefore cannot be reviewed with the Skill.

The workflow invokes a script through Bash and permits the synchronization script to be supplied through a configurable path. No checksum, signature, trusted-directory restriction, file-owner validation, permission check, canonical-path validation, or approval immediately before execution is documented.

Consequently, the effective executable payload is determined by mutable files outside the reviewed package. Any actor capable of replacing or modifying those files can convert a legitimate scheduled workflow into arbitrary command execution under the agent's operating-system account.

Attack Path

1. An attacker gains write access to {{workspace}}/memory/scripts/memcore_evening.sh, the configured {{sync_script}}, or a directory used to resolve obsidian-sync.
2. The attacker replaces the script or modifies it to include arbitrary shell commands.
3. The scheduled evening, morning, or synchronization workflow reaches the documented execution step.
4. Bash or the command resolver loads the attacker-controlled script.
5. The malicious commands execute with the same filesyste ...[truncated 816 chars]

Remediation

View remediation

Remediation Suggestions

• Bundle all required scripts inside the reviewed package so their behavior is included in security review.
• Pin each executable to a cryptographic hash or verify a trusted digital signature before execution.
• Resolve scripts through canonical absolute paths and reject symlinks or paths outside an approved directory.
• Verify that scripts and parent directories are owned by the expected account and are not writable by other users.
• Remove arbitrary executable path configuration or restrict it to a signed allowlist.
• Execute scripts with a minimal environment, fixed PATH, sanitized variables, and least-privilege filesystem access.
• Require explicit approval before first execution and after any script content or hash change.
• Run synchronization in a sandbox with access only to the files required for that operation.
• Log script identity, hash, owner, arguments, start time, exit status, and modified files for every invocation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

These instructions direct the agent to continuously capture user-provided financial details, preferences, corrections, schedules, and tasks into persistent logs and archives across several layers of storage. This is dangerous because it normalizes broad collection and long-term retention of sensitive personal data without clear minimization, consent boundaries, or safeguards, increasing exposure if files are accessed, synced, or mishandled.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs extraction of accounting CSVs, asset snapshots, and related financial records into derived summary artifacts such as money.md, creating consolidated financial intelligence in a persistent location. Aggregating sensitive account and asset data into summaries increases the blast radius of a compromise and may expose more than the original source files, especially when combined with sync and archival behaviors.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill advertises automatic memory maintenance and Obsidian synchronization across multiple storage locations, which can modify local files and transmit user-derived data to another repository or vault, but it does not clearly warn the user about those side effects. Because the workflow includes persistent storage of potentially sensitive notes and automated sync, a user may unknowingly enable data propagation beyond the current session.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states that MEMORY.md is automatically pruned when it exceeds size or age thresholds, but it does not prominently warn that older content may be deleted. Silent retention trimming on a memory file can cause unexpected data loss, especially when the file is meant to preserve long-term lessons and user preferences.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrase at line 21 is broad enough to match common user requests about memory or knowledge management, which can cause unintended activation of the skill. In an agent environment, overbroad activation can route ordinary conversations into a memory pipeline that stores, summarizes, or propagates user content without sufficiently clear user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger phrase at line 22 is overly general and lacks contextual constraints, increasing the chance that ordinary discussion about knowledge extraction or linking will activate the skill. Because this skill is designed for automated memory maintenance and synchronization, accidental activation could lead to unintended retention, transformation, or export of sensitive conversation data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file presents all user-facing instructions and behavior descriptions in Chinese, which can amount to a language policy issue if the skill effectively assumes a single language without offering a choice. There is no note that the skill is Chinese-only, region-specific, or that users may select another language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The summary, description, and Chinese display name are written in Chinese, while the manifest does not indicate any language choice or opt-in behavior. This can create a language/locale policy concern if the skill is surfaced to users who have not chosen Chinese as their preferred language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.