Security audit

enterprise-memory-skill

Security checks across malware telemetry and agentic risk

Overview

This is a real long-term memory skill, but it can automatically store and reuse conversation-derived text with weak user visibility, retention, and deletion controls.

Install only if you intentionally want durable agent memory. Before enabling it, confirm where the database is stored, whether model downloads are allowed, how users can inspect and delete stored memories, and whether your deployment adds consent, secret/PII filtering, retention limits, access controls, and encryption.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README explicitly markets persistent, automatic long-term memory for an agent but does not warn operators or end users that conversation content may be retained across sessions. In an agent context, undocumented persistence can lead to unexpected storage of sensitive data, privacy violations, and compliance issues because users may reasonably assume chats are ephemeral unless told otherwise.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation advertises natural-language and JSON-triggered add/delete/update memory operations without warning that the skill can automatically alter or remove stored data. In an LLM-driven system, this increases the risk of prompt-triggered unintended state changes, data poisoning, or loss of important stored information if users or model outputs invoke memory actions unexpectedly.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill persists user-provided memory content via the backing VectorStorage and explicitly saves the database on shutdown, but this file provides no consent flow, disclosure, retention control, or sensitivity filtering. In a long-term memory plugin, stored content can easily include secrets, personal data, or confidential enterprise information, creating privacy and data exposure risk if the host or storage layer is later accessed or compromised.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill writes arbitrary user-provided text directly into long-term memory via `add_text(...)` without any consent gate, warning, sensitivity filtering, or policy check. In an agent setting, this can cause unintended persistence of secrets, prompt-injected instructions, or other sensitive data that may later be retrieved and influence future model behavior.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code serializes all stored memory entries, including raw text and metadata, directly to disk via pickle without any consent flow, disclosure, retention controls, or protection at rest. In an agent context, this can silently persist potentially sensitive user prompts, secrets, or personal data, increasing privacy and data exposure risk if the host is shared or compromised.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Initializing SentenceTransformer with a model name may cause the runtime to download model artifacts from remote registries if they are not already cached, which creates undeclared outbound network access. In sensitive environments this can leak usage metadata, violate offline assumptions, or create supply-chain exposure from externally fetched model files.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.