ForesigxtMemory

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:56 AM UTC
• Version: 1.0.0

Overview

This memory skill is coherent and not malicious, but it should be reviewed because it relies on unpinned global third-party installs that will handle persistent private memory data.

Review before installing. Prefer pinned versions or a local sandboxed install, verify the npm package and qmd source you will run, keep the vault scoped to non-sensitive data unless you trust the tools, confirm whether embedding/search sends vault content to any external service, and back up before migration or auto-linking operations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: INSTALL.md:3
• Finding: Unpinned Global Installation of a Third-Party npm Package## Vulnerability Details **File Location**: `INSTALL.md:3-7` **Additional Location**: `SKILL.md:13-17` **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g @foresigxt/foresigxt-cli-memory ``` ### Technical Analysis The installation documentation directs users to globally install `@foresigxt/foresigxt-cli-memory` without specifying an exact version or verifying package integrity. Consequently, the package manager resolves the dependency to whichever release is current when the command is run. The executable source of this package is not included in the audited artifact, so its installation scripts and runtime behavior could not be independently reviewed. A compromised npm package, maintainer account, publishing token, or future release could introduce attacker-controlled installation or runtime code after this Skill has already been reviewed. The global installation scope increases exposure by placing the executable in the user's global command environment. The command does not itself request elevated privileges, so the resulting privileges ordinarily remain those of the invoking user. ### Attack Path 1. An attacker compromises the package publisher, npm account, publishing token, or upstream release process. 2. The attacker publishes a malicious version under the existing package name. 3. A user follows the Skill documentation and runs the unpinned installation command. 4. npm resolves the package to the malicious current release. 5. Package lifecycle scripts may execute during installation, or malicious behavior may execute when the user invokes `fsxmemory`. 6. The malicious package operates with the invoking user's permissions and may access files available to that account, including configured memory vaults and workspace data. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the privileges of the user performing the inst ...[truncated 568 chars]
• Remediation: ## Remediation Suggestions 1. Pin the package to an explicitly reviewed version: ```bash npm install -g @foresigxt/foresigxt-cli-memory@1.3.1 ``` 2. Publish and document expected package integrity hashes or signed release provenance. 3. Verify npm provenance and maintain reproducible release artifacts. 4. Prefer project-local installation over global installation: ```bash npm install --save-exact @foresigxt/foresigxt-cli-memory@1.3.1 ``` 5. Commit an appropriate lockfile when distributing the dependency through a project. 6. Disable lifecycle scripts during initial inspection where practical: ```bash npm install --ignore-scripts --save-exact @foresigxt/foresigxt-cli-memory@1.3.1 ``` 7. Audit lifecycle scripts and executable source before enabling or invoking the package. 8. Run the CLI under least privilege and restrict its vault path to data that it legitimately requires.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:244
• Finding: Mutable GitHub Dependency Installed Globally Through Bun## Vulnerability Details **File Location**: `SKILL.md:244-253` **Vulnerability Type**: Globally installed dependency sourced from a mutable GitHub reference **Risk Level**: Medium ### Vulnerable Code ```bash # Install qmd bun install -g github:tobi/qmd # Add vault as collection qmd collection add /path/to/vault --name my-memory --mask "**/*.md" # Update index qmd update && qmd embed ``` ### Technical Analysis The documentation installs `qmd` directly from the `github:tobi/qmd` repository without specifying an immutable commit hash or signed release. The effective dependency can therefore change as the repository's default branch changes. The installed tool is subsequently instructed to index and embed all Markdown files in the configured memory vault. If the repository, maintainer account, or default branch were compromised, malicious code could be delivered to users who run the documented installation command. Because the tool is globally installed and later receives broad access to the vault, a compromised version could read or alter indexed documents within the invoking user's access boundaries. No malicious code from `qmd` is present in the audited artifact, and this finding does not establish that the referenced repository is currently compromised. It identifies an unsafe and mutable dependency acquisition method. ### Attack Path 1. An attacker compromises the referenced GitHub repository, a maintainer account, or the repository's release workflow. 2. The attacker modifies the default branch or dependency metadata to include malicious code. 3. A user runs `bun install -g github:tobi/qmd`. 4. Bun retrieves the current repository state rather than a previously reviewed immutable revision. 5. Malicious lifecycle behavior may execute during installation, or malicious logic executes when `qmd` is invoked. 6. The user runs `qmd collection add`, `qmd update`, or `qmd embed`, granting the compromised tool access to Markdown documents in the selected vaul ...[truncated 746 chars]
• Remediation: ## Remediation Suggestions 1. Pin the GitHub dependency to a reviewed immutable commit: ```bash bun install -g github:tobi/qmd#<full-reviewed-commit-sha> ``` 2. Prefer a signed, versioned package release with published checksums and provenance. 3. Avoid global installation where a project-local or isolated execution environment is sufficient. 4. Review package lifecycle scripts and transitive dependencies before installation. 5. Execute indexing in a sandbox or container with read-only vault access unless modification is explicitly required. 6. Limit the collection path and file mask to the minimum necessary data. 7. Document whether embedding or search operations send content to external services; require explicit user approval before any remote transfer. 8. Periodically re-review and deliberately update the pinned revision rather than tracking a mutable branch automatically.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Credential Access

High

• Category: Privilege Escalation

Content

## Setup

1. Install the package globally (see above)
2. Copy .env.example to .env and configure your vault path
3. Review SKILL.md for complete usage guide
4. Start using: `fsxmemory init ~/memory`

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## Setup

1. Install the package globally (see above)
2. Copy .env.example to .env and configure your vault path
3. Review SKILL.md for complete usage guide
4. Start using: `fsxmemory init ~/memory`

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## Setup

1. Install the package globally (see above)
2. Copy .env.example to .env and configure your vault path
3. Review SKILL.md for complete usage guide
4. Start using: `fsxmemory init ~/memory`

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## Setup

1. Install the package globally (see above)
2. Copy .env.example to .env and configure your vault path
3. Review SKILL.md for complete usage guide
4. Start using: `fsxmemory init ~/memory`

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## Setup

1. Install the package globally (see above)
2. Copy .env.example to .env and configure your vault path
3. Review SKILL.md for complete usage guide
4. Start using: `fsxmemory init ~/memory`

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## Setup

1. Install the package globally (see above)
2. Copy .env.example to .env and configure your vault path
3. Review SKILL.md for complete usage guide
4. Start using: `fsxmemory init ~/memory`

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## Setup

1. Install the package globally (see above)
2. Copy .env.example to .env and configure your vault path
3. Review SKILL.md for complete usage guide
4. Start using: `fsxmemory init ~/memory`

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Ae1

High

• Category: analysis-evasion

Content

- `SKILL.md` - Complete documentation and reference

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Session Persistence

Medium

• Category: Rogue Agent

Content

**For isolated workspace memory** (each workspace has its own vault):

```bash
# Create .env in workspace root
echo 'FSXMEMORY_PATH=/path/to/workspace/memory' > .env

# All agents in THIS workspace use this isolated vault

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# Migration flags
--dry-run           # Preview changes without modifying files
--backup            # Create backup before migration (recommended)
--force             # Skip confirmation prompts
--verbose           # Show detailed progress
--rollback          # Restore from last backup
```

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.