Three-Dimensional Memory

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:45 PM UTC
• Version: 1.0.0

Overview

This skill openly creates local AI memory, but it tells agents to save full chat transcripts and preferences without clear safeguards, so it should be reviewed before installation.

Install only if you are comfortable with the agent maintaining local records of your conversations. Prefer summaries over full transcripts, exclude secrets and sensitive personal or business data, restrict file access, avoid committing or syncing memory folders, and set a deletion or retention routine.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:94
• Finding: Plaintext Retention of Complete Conversations and User Preferences## Vulnerability Details **File Location**: `SKILL.md:94-113` **Additional Locations**: `SKILL.md:31-40`, `SKILL.md:190-195`, `examples/daily-workflow.sh:42-47` **Vulnerability Type**: Unprotected storage of potentially sensitive conversation data **Risk Level**: Medium ### Vulnerable Code From `SKILL.md:94-113`: ```markdown ### Step 2: Daily Workflow **Every day**, the AI should: 1. **Write to `memory/YYYY-MM-DD.md`** - Summary of today's work - Decisions made - Tasks completed 2. **Backup conversation to `AI-memory-backup/backup-YYYYMMDD.md`** - Full transcript - Important context - User preferences learned 3. **Update relevant `topic-memory/` folders** - Add new documents to projects - Update decision records - Consolidate knowledge ``` Supporting implementation guidance from `examples/daily-workflow.sh:42-47`: ```bash # Dimension 2: Backup conversation echo "💬 Dimension 2: Conversation Backup" echo "To backup today's conversation:" echo " 1. Copy entire chat transcript" echo " 2. Save to: AI-memory-backup/backup-${YEAR}${MONTH}${DAY}.md" echo " 3. Include: user messages, AI responses, key decisions" echo "" ``` The declared data scope in `SKILL.md:31-40` includes: ```markdown ### Dimension 2: Conversation Stream ``` ```markdown **Purpose**: Full context preservation, searchable dialogue history **Update frequency**: Per conversation **Content**: Every word exchanged, including user messages and AI responses ``` ### Technical Analysis The Skill explicitly directs the agent or user to retain every exchanged message, important context, and learned user preferences in ordinary Markdown files. It provides no controls for identifying or redacting credentials, authentication tokens, personal information, confidential business data, or other secrets before persistence. The workflow also lacks explicit consent checks, restrictive file permissions, encryption, retention limits, secure deletion procedures, and isolati ...[truncated 1891 chars]
• Remediation: ## Remediation Suggestions 1. Store concise, user-approved summaries by default instead of complete transcripts. 2. Require explicit opt-in before retaining full conversations or inferred preferences. 3. Add automated redaction for passwords, API keys, access tokens, private keys, financial details, and personal information. 4. Warn users never to place secrets in persistent memory and provide a review step before writing files. 5. Create storage with owner-only permissions, such as mode `0600` for files and `0700` for directories. 6. Encrypt sensitive transcript data at rest using keys managed outside the workspace. 7. Establish configurable retention periods and secure deletion procedures. 8. Exclude memory directories from version control, public archives, and cloud synchronization by default. 9. Treat restored transcript text as untrusted data, not executable instructions, and clearly separate quoted conversation content from agent configuration or persistent rules. 10. Document how users can inspect, export, redact, and delete retained data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (13)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README explicitly promotes capturing complete conversation transcripts and preserving every word exchanged, but provides no warning, consent model, retention limits, or guidance for handling sensitive data. In a memory/archive skill, this normalizes broad collection of potentially confidential or regulated information, increasing privacy and data exposure risk.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The README repeatedly encourages retaining exact user statements and searchable history across backups and topic memories, which semantically promotes over-collection and long-term storage of sensitive user data. In a tool designed to centralize and make information easier to retrieve, this increases the blast radius of any accidental disclosure, unauthorized access, or future misuse.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs storing complete conversation transcripts and learned user preferences without mentioning consent, minimization, redaction, access controls, or retention limits. This creates a privacy and data-handling risk because sensitive personal, business, or credential-like information shared during normal use could be retained indefinitely in plain text.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The instruction to preserve 'every word exchanged' creates a standing mechanism to capture sensitive user data in raw form, including secrets, personal information, and confidential business content that may appear in ordinary conversations. Because the storage is described as markdown backups in workspace directories, the data may be easily discoverable, copied, or mishandled by other tools or users with filesystem access.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The daily workflow operationalizes routine collection of full conversations and learned preferences, turning the risky behavior into persistent default practice rather than an occasional edge case. This increases exposure over time because sensitive data accumulates continuously, broadening the consequences of unauthorized access, leakage, or reuse.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script explicitly instructs users to save the entire chat transcript, including user messages, AI responses, and key decisions, into a persistent backup file. That creates a data retention and privacy risk because transcripts commonly contain sensitive personal, operational, or proprietary information, and the script provides no minimization, redaction, consent, retention, or access-control guidance.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: Persistently backing up complete chat transcripts and preferences creates a natural-language data store that may contain credentials, personal information, internal business context, or other sensitive material. Because the script normalizes routine archival without safeguards, it increases the risk of accidental leakage, unauthorized access, and noncompliant retention.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The example workflow reinforces broad collection by recommending storage of full transcripts, important context, and user preferences. In a memory/archive skill, this context makes the issue more dangerous because the feature is specifically oriented toward long-term persistence of conversational data, increasing the chance of overcollection, disclosure, and later misuse.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The workflow's direction to save full transcripts, important context, and user preferences encourages indiscriminate collection of sensitive conversational data. Given the skill's purpose as a memory system, this is not an isolated note but a repeated operational pattern, which materially increases long-term privacy and data exposure risk.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The example explicitly models storing full AI conversation transcripts in a backup directory and later retrieving exact quotes, but it provides no guidance on redaction, minimization, retention, or access controls. In a memory/backups skill, this is risky because transcripts often contain sensitive business, personal, or credential-like data that could be exposed through over-broad storage, search, or sharing.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The 'How This Helps' section promotes fast cross-retrieval across work logs, topic memory, and full conversation backups as an unqualified benefit, without mentioning privacy boundaries or least-privilege access. That can normalize broad indexing and retrieval of sensitive internal decisions and verbatim conversations, increasing the chance of unintended disclosure in real deployments.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The file contains a user-facing testimonial in Chinese while the rest of the README is in English, with no translation or language-choice context. This can violate language/locale consistency expectations because it introduces content in a specific language without user opt-in or justification.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The title line includes Chinese text alongside English, which imposes a multilingual presentation without any user opt-in or explanation of a locale-specific purpose. Under the stated policy, language constraints or forced locale choices should be optional or clearly justified.

Static analysis

No suspicious patterns detected.