Three-Dimensional Memory

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:45 PM UTC
• Version: 1.0.0

Overview

This skill openly creates local AI memory, but it tells agents to save full chat transcripts and preferences without clear safeguards, so it should be reviewed before installation.

Install only if you are comfortable with the agent maintaining local records of your conversations. Prefer summaries over full transcripts, exclude secrets and sensitive personal or business data, restrict file access, avoid committing or syncing memory folders, and set a deletion or retention routine.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:94

Finding

Plaintext Retention of Complete Conversations and User Preferences

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:94-113
Additional Locations: SKILL.md:31-40, SKILL.md:190-195, examples/daily-workflow.sh:42-47
Vulnerability Type: Unprotected storage of potentially sensitive conversation data
Risk Level: Medium

Vulnerable Code

From SKILL.md:94-113:

markdown

### Step 2: Daily Workflow

**Every day**, the AI should:

1. **Write to `memory/YYYY-MM-DD.md`**
   - Summary of today's work
   - Decisions made
   - Tasks completed

2. **Backup conversation to `AI-memory-backup/backup-YYYYMMDD.md`**
   - Full transcript
   - Important context
   - User preferences learned

3. **Update relevant `topic-memory/` folders**
   - Add new documents to projects
   - Update decision records
   - Consolidate knowledge

Supporting implementation guidance from examples/daily-workflow.sh:42-47:

bash

# Dimension 2: Backup conversation
echo "💬 Dimension 2: Conversation Backup"
echo "To backup today's conversation:"
echo "  1. Copy entire chat transcript"
echo "  2. Save to: AI-memory-backup/backup-${YEAR}${MONTH}${DAY}.md"
echo "  3. Include: user messages, AI responses, key decisions"
echo ""

The declared data scope in SKILL.md:31-40 includes:

markdown

### Dimension 2: Conversation Stream

markdown

**Purpose**: Full context preservation, searchable dialogue history  
**Update frequency**: Per conversation  
**Content**: Every word exchanged, including user messages and AI responses

Technical Analysis

The Skill explicitly directs the agent or user to retain every exchanged message, important context, and learned user preferences in ordinary Markdown files. It provides no controls for identifying or redacting credentials, authentication tokens, personal information, confidential business data, or other secrets before persistence.

The workflow also lacks explicit consent checks, restrictive file permissions, encryption, retention limits, secure deletion procedures, and isolati ...[truncated 1891 chars]

Remediation

View remediation

Remediation Suggestions

1. Store concise, user-approved summaries by default instead of complete transcripts.
2. Require explicit opt-in before retaining full conversations or inferred preferences.
3. Add automated redaction for passwords, API keys, access tokens, private keys, financial details, and personal information.
4. Warn users never to place secrets in persistent memory and provide a review step before writing files.
5. Create storage with owner-only permissions, such as mode 0600 for files and 0700 for directories.
6. Encrypt sensitive transcript data at rest using keys managed outside the workspace.
7. Establish configurable retention periods and secure deletion procedures.
8. Exclude memory directories from version control, public archives, and cloud synchronization by default.
9. Treat restored transcript text as untrusted data, not executable instructions, and clearly separate quoted conversation content from agent configuration or persistent rules.
10. Document how users can inspect, export, redact, and delete retained data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (13)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly promotes capturing complete conversation transcripts and preserving every word exchanged, but provides no warning, consent model, retention limits, or guidance for handling sensitive data. In a memory/archive skill, this normalizes broad collection of potentially confidential or regulated information, increasing privacy and data exposure risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README repeatedly encourages retaining exact user statements and searchable history across backups and topic memories, which semantically promotes over-collection and long-term storage of sensitive user data. In a tool designed to centralize and make information easier to retrieve, this increases the blast radius of any accidental disclosure, unauthorized access, or future misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs storing complete conversation transcripts and learned user preferences without mentioning consent, minimization, redaction, access controls, or retention limits. This creates a privacy and data-handling risk because sensitive personal, business, or credential-like information shared during normal use could be retained indefinitely in plain text.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instruction to preserve 'every word exchanged' creates a standing mechanism to capture sensitive user data in raw form, including secrets, personal information, and confidential business content that may appear in ordinary conversations. Because the storage is described as markdown backups in workspace directories, the data may be easily discoverable, copied, or mishandled by other tools or users with filesystem access.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The daily workflow operationalizes routine collection of full conversations and learned preferences, turning the risky behavior into persistent default practice rather than an occasional edge case. This increases exposure over time because sensitive data accumulates continuously, broadening the consequences of unauthorized access, leakage, or reuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script explicitly instructs users to save the entire chat transcript, including user messages, AI responses, and key decisions, into a persistent backup file. That creates a data retention and privacy risk because transcripts commonly contain sensitive personal, operational, or proprietary information, and the script provides no minimization, redaction, consent, retention, or access-control guidance.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Persistently backing up complete chat transcripts and preferences creates a natural-language data store that may contain credentials, personal information, internal business context, or other sensitive material. Because the script normalizes routine archival without safeguards, it increases the risk of accidental leakage, unauthorized access, and noncompliant retention.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The example workflow reinforces broad collection by recommending storage of full transcripts, important context, and user preferences. In a memory/archive skill, this context makes the issue more dangerous because the feature is specifically oriented toward long-term persistence of conversational data, increasing the chance of overcollection, disclosure, and later misuse.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The workflow's direction to save full transcripts, important context, and user preferences encourages indiscriminate collection of sensitive conversational data. Given the skill's purpose as a memory system, this is not an isolated note but a repeated operational pattern, which materially increases long-term privacy and data exposure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The example explicitly models storing full AI conversation transcripts in a backup directory and later retrieving exact quotes, but it provides no guidance on redaction, minimization, retention, or access controls. In a memory/backups skill, this is risky because transcripts often contain sensitive business, personal, or credential-like data that could be exposed through over-broad storage, search, or sharing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The 'How This Helps' section promotes fast cross-retrieval across work logs, topic memory, and full conversation backups as an unqualified benefit, without mentioning privacy boundaries or least-privilege access. That can normalize broad indexing and retrieval of sensitive internal decisions and verbatim conversations, increasing the chance of unintended disclosure in real deployments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The file contains a user-facing testimonial in Chinese while the rest of the README is in English, with no translation or language-choice context. This can violate language/locale consistency expectations because it introduces content in a specific language without user opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The title line includes Chinese text alongside English, which imposes a multilingual presentation without any user opt-in or explanation of a locale-specific purpose. Under the stated policy, language constraints or forced locale choices should be optional or clearly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.