memos-memory-guide

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:07 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed memory guide, but it deserves review because it also instructs agents to write public memories and install or publish skills persistently without clear user confirmation.

Install only if you are comfortable with the agent searching long-term conversation history and using public cross-agent memory. Before use, require explicit user confirmation for any public memory write, skill installation, publishing, or unpublishing, and avoid using it for sensitive prior conversations unless the user clearly asks for that lookup.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill is presented as a memory-recall guide, but its activation text and tool list also encourage use of skill discovery, installation, and publishing capabilities unrelated to simple past-conversation retrieval. This broadens the operational scope of the skill and can cause the agent to invoke higher-risk capability-transfer actions in contexts where only memory lookup was expected.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation guidance says to use the skill whenever the user refers to past chats, preferences, or history, which is broad enough to trigger memory access during many ordinary conversations. That increases the likelihood of unnecessary retrieval of sensitive historical content and normalizes memory use without a clear need-to-know threshold.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill does not warn that searching past conversations may surface sensitive historical data or that public memories are visible across agents. Without disclosure and consent language, users may not realize their request could trigger retrieval or sharing beyond the immediate conversation context.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The documentation explicitly expands from personal conversation history into cross-agent knowledge sharing and public skill discovery. That scope expansion increases the chance that information learned in one context is propagated or that unrelated public capabilities are introduced, which exceeds the least-privilege expectations for a memory helper.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

## How memory is provided each turn

- **Automatic recall (hook):** At the start of each turn, the system runs a memory search using the user's current message and injects relevant past memories into your context. You do not need to call any tool for that.
- **When that is not enough:** If the user's message is very long, vague, or the automatic search returns **no memories**, you should **generate your own short, focused query** and call `memory_search` yourself.
- **Memory isolation:** Each agent can only see its own memories and memories marked as `public`. Other agents' private memories are invisible to you.

• Confidence: 80% confidence
• Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Installing and publishing skills creates persistence and expands future agent capabilities, which is materially different from transient memory recall. Embedding these actions in a memory-oriented guide risks silent capability creep and can lead to unreviewed reuse or distribution of skills outside the user's immediate request.

Static analysis

No suspicious patterns detected.