Security audit

ForesigxtMemory

Security checks across malware telemetry and agentic risk

Overview

This is a coherent local memory-management skill, with privacy and supply-chain cautions but no artifact-backed malicious or Review-level behavior.

Install only if you trust the Foresigxt npm package and the optional qmd GitHub package. Prefer workspace-specific vaults for sensitive projects, avoid storing secrets or regulated personal data, keep vault and .env files out of public repos or broad sync folders, and run migrations with --dry-run and backup first.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

Confidence: 93% confidence
Finding: The documentation tells users to create a workspace-root .env file containing FSXMEMORY_PATH, which exposes local filesystem structure and configuration if the file is accidentally committed, shared, or bundled. While the value is not a secret credential, it is still sensitive configuration data and can leak usernames, host layout, project structure, or internal storage conventions that aid reconnaissance.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.