Security audit

tokst-memory

Security checks across malware telemetry and agentic risk

Overview

This memory skill is mostly coherent, but it should be reviewed because it tells agents to automatically store and retrieve broad persistent user/project context and uses unverified remote installer commands.

Install only if you want an agent to use persistent memory and are comfortable with broad context being saved and reused. Prefer Local mode for private work, avoid secrets or sensitive documents, review/delete stored memories regularly, and inspect or verify the installer rather than blindly running the piped shell or PowerShell commands.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The instruction to "Store silently — never ask for permission" encourages durable retention of user and project information without any consent gate, while only later advising that credentials and raw reasoning should be excluded. In practice, an agent cannot reliably infer all sensitive data from natural language, so silent storage increases the chance that secrets, personal data, or other sensitive context will be persisted unintentionally.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README instructs users to execute remote installation scripts directly via shell and PowerShell pipes (`curl ... | bash` and `irm ... | iex`) without any warning, checksum verification, signature validation, or review step. This is dangerous because compromise of the hosting domain, CDN, DNS, TLS termination, or install script supply chain would result in immediate arbitrary code execution on the user's machine.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The skill instructs users to execute a remote shell script directly via curl-pipe-to-bash, which bypasses review and grants the downloaded content immediate code execution on the host. In an agent skill context, this is especially dangerous because users may copy commands verbatim and the remote script can change over time without visibility or integrity verification.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The Windows instructions use Invoke-RestMethod piped to iex, which executes remote PowerShell content immediately with the user's privileges. This creates a supply-chain and tampering risk identical to shell pipe-to-exec patterns, with no review, signature validation, or safety warning.

Missing User Warnings

High

Confidence: 98% confidence
Finding: This section explicitly instructs the agent to persist user facts, project facts, decisions, preferences, tasks, architecture, and notes silently, with no notice or consent disclosure. In a memory skill, that creates a direct privacy and data-governance risk because broad categories of potentially sensitive information may be retained and later surfaced across sessions or workspaces.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill explicitly instructs the agent to store user facts, decisions, preferences, tasks, and other context automatically without asking permission or warning the user that the data will persist across sessions. This creates a real privacy and data-governance risk because sensitive personal or project information may be retained, reused, or routed to external/cloud workspaces beyond the user’s expectations.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The instructions mandate loading persistent memory at the start of every conversation, removing user choice and normalizing automatic cross-session retrieval of prior context. That increases the chance of unnecessary access to sensitive historical data and can expose prior user or project information in contexts where it is not needed.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The instructions explicitly tell the agent to persist content and manage file attachments, including downloading attachments, but they provide no requirement to obtain user consent, verify sensitivity, or warn that data may be stored durably outside the current session. In a memory skill, this increases the risk of unintentionally retaining sensitive user data, internal documents, or regulated content and later resurfacing or exfiltrating it across sessions or workspaces.

Ssd 3

Medium

Confidence: 96% confidence
Finding: Persisting natural-language facts, preferences, tasks, and notes without permission creates a durable data retention and leakage path, especially because these categories often contain personal, confidential, or contextual business information. The surrounding skill context makes this more dangerous, not less, because the tool is specifically designed for cross-session and potentially cross-workspace memory, increasing blast radius if unsafe data is stored or later retrieved.

Ssd 3

Medium

Confidence: 96% confidence
Finding: Automatic storage of facts, preferences, architecture, tasks, and notes creates a durable natural-language record that may contain sensitive information, trade secrets, or personal data. Because storage is instructed without permission and with broad categories, the skill increases the risk of retention, later disclosure, and cross-session leakage.

Ssd 3

Medium

Confidence: 93% confidence
Finding: Requiring persistent-memory retrieval in every session encourages broad collection and reuse of prior user and project data regardless of necessity. In a memory skill this context makes the behavior especially risky because the whole purpose is cross-session persistence, so mandatory retrieval expands exposure of historical data and can amplify privacy mistakes.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.