Slim Project Memory

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:45 PM UTC
• Version:
  1.0.3

Overview

This skill reorganizes project memory and documentation, and its sensitive handling is disclosed and mostly constrained to env-var references rather than real secrets.

Install only if you want an agent to reorganize project documentation and Claude memory files in the target repository. Review the proposed migration map before edits, verify CLAUDE.local.md is gitignored, and do not put real passwords, tokens, database URLs, or API keys into markdown files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: This is a true issue because the case study includes a concrete execution step to create `CLAUDE.local.md` containing live DB URLs, FalkorDB credentials, and a GitHub PAT. Although the document warns at the top that this is the deprecated approach, preserving the old workflow in procedural form can still cause readers or downstream agents to replicate insecure secret-handling practices and normalize plaintext credential storage in markdown files.

VirusTotal

63/63 vendors flagged this skill as clean.