Dogearai Memory

• Outcome: Review
• Latest audit: Jun 29, 2026 · 11:21 PM UTC
• Version: 1.0.1

Overview

This is a real memory integration, but it can automatically create a remote account, store a local token, and send or retrieve long-term personal/project context with too little user control.

Install only if you want DogearAI to hold long-term memory for your AI tools. Before first use, understand that it may create a DogearAI account, store a token under ~/.dogear/token, send saved facts to DogearAI, and silently retrieve prior memories during future tasks. Avoid storing secrets, credentials, regulated data, or sensitive business details unless you have reviewed DogearAI's privacy and account controls.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Tainted flow: 'req' from os.environ.get (line 32, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

if data is not None:
        req.add_header("Content-Type", "application/json")
    try:
        with urllib.request.urlopen(req, timeout=30) as r:
            return r.status, r.read().decode("utf-8")
    except urllib.error.HTTPError as e:
        return e.code, e.read().decode("utf-8")

• Confidence: 96% confidence
• Finding: The request destination is derived from the untrusted DOGEAR_BASE_URL environment variable and then used directly in urllib.request.urlopen. In an agent/skill context, environment variables may be attacker-controlled or influenced by the invoking platform, so this can redirect all memory contents and bearer tokens to an arbitrary host, causing SSRF and credential exfiltration.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs the agent to execute a local Python script that can use shell, network, environment variables, and write to the filesystem, yet no explicit permissions or trust boundaries are declared. In this context, that is dangerous because first use auto-creates a remote account and stores a token locally, creating both outbound data flow and local state changes without a clear permission gate.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README explicitly states that durable user facts are stored and that the server classifies and files them, but it does not give a clear privacy warning about sending potentially sensitive personal or project context to a third-party service. In a memory skill, users are likely to submit long-lived preferences, project background, decisions, and other sensitive data, so omission of data-handling disclosure can lead to uninformed sharing and privacy harm.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The activation guidance is broad enough that the skill may trigger in many normal conversations and automatically pull remote memory at task start. That increases the chance of unnecessary disclosure of personal or project context to the model and normalizes background access to an external memory service without a strong need signal.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The 'When to recall' section uses common phrases like 'my project' or 'my preferences' as triggers, which overlap heavily with everyday requests. In a memory skill tied to a remote account, that makes unintended retrieval of long-term user data more likely and can expose stale or sensitive context when no explicit recall was desired.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Although the text mentions zero setup and auto-creation, it does not present the privacy and local-state consequences as a prominent warning before use. First execution creates an external account and writes a token to ~/.dogear/token, which is a meaningful side effect that users may not expect from a 'just call it' skill.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill encourages saving durable user facts across tools, including preferences, decisions, project background, commitments, and TODOs, without a prominent warning that this information is transmitted to an external service and may include sensitive personal or business context. In practice, that can lead to overcollection and persistence of data users did not realize would leave the current environment.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The tool silently auto-registers a remote account and persists its token the first time a command needs authentication, without requiring prior user confirmation at the point of action. In a memory skill handling durable personal/project context, this creates privacy and consent risk because users may unknowingly establish a persistent external account and local credential.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The remember/context command flow sends user-supplied memory content and recalled context to a remote service without an explicit warning in the command path. Because this skill is specifically designed to store long-term personal and project information across tools, the absence of a just-in-time disclosure increases the chance of unintended sensitive data disclosure.

Session Persistence

Medium

• Category: Rogue Agent

Content

def _auto_register():
    """No token anywhere -> create a zero-config anonymous account, save & return its token."""
    status, out = _http("POST", "/v1/auth/anonymous", body={"label": "auto"})
    if status >= 400:
        sys.exit(f"ERROR: could not auto-create a DogearAI account ({status}).\n{out}")

• Confidence: 84% confidence
• Finding: The code creates a long-lived anonymous session and stores its token on disk, enabling cross-run persistence of access to the user's remote memory account. In this skill's context, that persistent token protects potentially sensitive long-term memories, so unwanted session creation or reuse can expand privacy impact if the local machine or account context is shared.

Static analysis

No suspicious patterns detected.