Memos Memory Guide Local

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:14 AM UTC
• Version: 1.0.0

Overview

This skill is a memory helper, but it asks the agent to search and expand stored past conversations broadly without clear consent or limits.

Review this skill before installing if your stored conversations may contain private, business, credential, or sensitive personal information. It is not showing malicious behavior, but it gives the agent broad ways to retrieve and expand prior conversation history and to install learned skills for future use without explicit approval language.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:11

Finding

Broad Retrieval of Persistent User Conversation History

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:11-66
Vulnerability Type: Sensitive conversation history access
Risk Level: Medium

Vulnerable Instruction Snippets

markdown

- **Automatic recall (hook):** At the start of each turn, the system runs a memory search using the user's current message and injects relevant past memories into your context. You do not need to call any tool for that.
- **When that is not enough:** If the user's message is very long, vague, or the automatic search returns **no memories**, you should **generate your own short, focused query** and call `memory_search` yourself.

markdown

### task_summary

- **What it does:** Returns the full task summary for a given `task_id`: title, status, and the complete narrative summary of that conversation task (steps, decisions, URLs, commands, etc.).
- **When to call:** A `memory_search` hit included a `task_id` and you need the full story of that task (e.g. what was done, what the user decided, what failed or succeeded).

markdown

### memory_timeline

- **What it does:** Expands context around a single memory chunk: returns the surrounding conversation messages (±N turns) so you see what was said before and after that excerpt.
- **When to call:** A `memory_search` hit is relevant but you need the surrounding dialogue (e.g. who said what next, or the exact follow-up question).
- **Parameters:** `chunkId` (from a search hit), optional `window` (default 2).
- **Effect:** You get a short, linear slice of the conversation around that chunk.

Technical Analysis

The skill instructs the agent to consume automatically recalled long-term conversation data on every turn and to perform additional self-generated searches when no memory is initially returned. Search results can then be expanded through task_summary and memory_timeline, exposing complete task narratives and surrounding messages rather than only the minimu ...[truncated 2066 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user consent before searching or expanding persistent conversation history.
2. Disable automatic recall by default, or limit it to clearly defined use cases where historical context is necessary.
3. Restrict every memory query to the current task and retrieve only the minimum relevant fields.
4. Do not automatically issue a new search merely because no memory block is present; first determine whether historical information is required.
5. Require separate confirmation before invoking task_summary or memory_timeline, because these operations expand the amount of exposed data.
6. Apply authorization checks so the active user and agent can access only memory records belonging to the correct account and permitted scope.
7. Redact credentials, authentication tokens, sensitive URLs, personal data, and confidential command output before memory content is returned.
8. Add limits for result count, timeline window, task-summary size, and retention period.
9. Record memory searches and expansion operations in an audit log visible to the user.
10. Treat recalled content as untrusted data rather than instructions, preventing historical prompt content from changing system policies or tool authorization.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs broad use of long-term memory whenever the user refers to past chats, preferences, or history, which can trigger retrieval in many ordinary conversations without a clear necessity check. That increases the chance of over-collection or unnecessary exposure of prior conversation data in contexts where the user did not explicitly intend memory lookups.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill centers on searching and using the user's past conversations but does not require any user-facing notice, consent cue, or privacy-sensitive handling guidance. In a memory system, this omission can lead to silent retrieval of sensitive historical data and reduce user awareness and control over how their stored conversations are being used.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

## How memory is provided each turn

- **Automatic recall (hook):** At the start of each turn, the system runs a memory search using the user's current message and injects relevant past memories into your context. You do not need to call any tool for that.
- **When that is not enough:** If the user's message is very long, vague, or the automatic search returns **no memories**, you should **generate your own short, focused query** and call `memory_search` yourself. For example:
  - User sent a long paragraph → extract 1–2 key topics or a short question and search with that.
  - Auto-recall said "no memories" or you see no memory block → call `memory_search` with a query you derive (e.g. the user's name, a topic they often mention, or a rephrased question).

Static analysis

No suspicious patterns detected.