Smart Memory

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:23 AM UTC
• Version: 3.1.0

Overview

This appears to be a real local memory tool, but it needs review because it persistently stores conversation data and runs local/server and dependency code with limited guardrails.

Install only if you are comfortable with a local service storing conversation history on disk and with the setup process downloading and executing dependencies. Review the installer, pin the source before use, restrict access to localhost, disable or gate auto-start/background behavior if unwanted, and avoid storing secrets or regulated data unless you add your own retention and deletion controls.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (52)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

for path in ["./smart-memory", "../smart-memory", "./skills/smart-memory"]:
        venv_activate = Path(path) / ".venv/bin/activate"
        if venv_activate.exists():
            subprocess.Popen(
                f"cd {path} && . .venv/bin/activate && python -m uvicorn server:app --host 127.0.0.1 --port 8000 > /tmp/smart-memory-server.log 2>&1 &",
                shell=True,
            )

• Confidence: 92% confidence
• Finding: subprocess.Popen( f"cd {path} && . .venv/bin/activate && python -m uvicorn server:app --host 127.0.0.1 --port 8000 > /tmp/smart-memory-server.log 2>&1 &", s

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if venv_activate.exists() and server_py.exists():
            cmd = f"cd {base}/smart-memory && . .venv/bin/activate && python -m uvicorn server:app --host 127.0.0.1 --port 8000 > /tmp/smart-memory-server.log 2>&1 &"
            subprocess.Popen(cmd, shell=True)
            time.sleep(3)
            
            try:

• Confidence: 96% confidence
• Finding: subprocess.Popen(cmd, shell=True)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises substantial capabilities including filesystem access, networking, shell, environment access, and MCP interaction, but the manifest shown does not declare permissions or user-facing trust boundaries. This creates a transparency and authorization gap: hosts or users may treat the skill as lower risk than it is, while the backend can still perform sensitive local and external actions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The description frames the skill as a local memory component, but the documented behavior extends into background cognition, prompt injection into active context, external summarizer hooks, rebuild/replay tooling, imports, auto-start/setup, and heuristic persistence. That mismatch is dangerous because security review, user consent, and host policy may be scoped to 'memory' while the skill actually alters prompts, processes retained data, and may invoke additional code paths or external models.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The embedder enables `trust_remote_code=True` by default when loading a Hugging Face/SentenceTransformer model, which allows execution of model-repository Python code during initialization. If the configured model is changed, the upstream repository is compromised, or an attacker influences model resolution, this can lead to arbitrary code execution on the host running the memory service.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This session primer silently escalates from reading/priming memory into process management by attempting to start a server on the user's machine. That exceeds the minimal expected capability for a primer script and can surprise users, especially in agent or automation contexts where local code execution should be narrowly scoped.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The helper silently spawns a background FastAPI/uvicorn server by invoking a shell command when the service is not already running. In a transcript/memory primer example, this expands behavior beyond simple context preparation and creates side effects such as process creation and shell execution, which can be risky if callers do not expect code to start local services automatically.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script does more than read local memory state: if the server is unavailable, it searches multiple paths, changes directories, and launches a background FastAPI service automatically. That behavior expands the trust boundary from passive memory lookup to autonomous process execution, which can run unintended code from whichever matching directory is found.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The installer fetches a fresh repository snapshot from the network and then runs `npm install`, which can execute package lifecycle scripts such as `postinstall`. That means installation is not limited to copying local memory files; it implicitly executes network-retrieved code, substantially increasing supply-chain and arbitrary-code-execution risk on the host.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The documented usage instructs users to pipe a remotely fetched script directly into `bash`, preventing meaningful review before execution. In a security-sensitive agent skill, this is especially dangerous because any compromise of the source repo, branch, or transport path can immediately become arbitrary shell execution on the user's system.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: This CLI is presented as a memory-priming/query tool, but it also attempts to discover, launch, and background a local service. That hidden side effect broadens its capabilities beyond the stated purpose, making it easier for users or higher-level agents to trigger process creation unexpectedly and reducing transparency around what code is executed.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The usage/docs frame the tool as querying a local memory server, but the implementation will also auto-start one if it is unavailable. This mismatch is security-relevant because users and orchestrating agents may grant it query-like trust while it actually performs process execution and persistence-like behavior.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The method accepts an optional session_id and reports the rebuild scope as session-scoped, but the implementation always clears derived state globally and replays all transcript messages via list_messages() with no session filter. This mismatch can cause operators, dependent components, or audit reviewers to believe only one session was rebuilt when the entire memory state was recomputed, leading to unintended cross-session effects, misleading audit trails, and unsafe administrative actions.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The API name rederive_memory_for_message and its audit text imply a targeted rebuild for a single message, but it actually triggers rebuild_from_transcripts(), which performs a full derived-state clear and full transcript replay. In a persistent memory system, this can produce unexpectedly broad side effects, mislead forensic review, and let a caller with access to a narrow-sounding endpoint induce system-wide recomputation affecting unrelated sessions and messages.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The activation criteria are broad enough that the agent may retrieve stored memory for many loosely related prompts without a clearly bounded need-to-know check. In a transcript-first persistent memory system, this can cause unnecessary access to historical user data and increase the chance of over-collection, unintended disclosure, or use of stale context in responses.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to access transcript-backed memory and direct inspection endpoints without any user-visible notice, consent step, or transparency mechanism. Because this skill is specifically designed for persistent local memory, silent recall of prior conversation data meaningfully raises privacy risk and can expose users to unexpected use of historical information.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The guide instructs hosts to persist full transcript messages and to use transcript and evidence inspection endpoints, but it does not warn that these operations may store or expose sensitive user content such as credentials, personal data, or internal business information. In a memory system explicitly designed for durable local transcript retention, omission of data-sensitivity, access-control, and redaction guidance can lead to unsafe integrations and unnecessary long-term exposure of confidential conversation data.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly performs persistent transcript logging and uses SQLite plus transcript storage as canonical memory, yet the documentation provides no warning about retention, sensitivity of captured conversations, or local disk writes. In a memory skill, this increases the likelihood that users unknowingly store secrets, personal data, or regulated content long-term on disk.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: Queuing failed commits into a local JSON retry file creates another persistence channel for potentially sensitive memory content, but the documentation does not warn users that failed operations may leave data behind on disk. This can expose fragments of conversation or derived facts to other local users, backups, or later unintended processing.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Remote code trust is enabled silently, so operators may believe they are only loading weights while the library is permitted to execute repository-supplied code. In a persistent local memory component, this increases risk because the service may run continuously with access to transcripts and local data, magnifying the consequences of a malicious or compromised model package.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script starts a background local server without notifying the user or asking for confirmation. Silent background execution can bypass user expectations, leave persistent processes running, and make forensic review harder because it writes logs to /tmp and detaches immediately.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The code transmits agent identity, the current user message, and hot-memory state to a local HTTP service without any explicit disclosure at the point of use. While the destination is localhost, the data may still be sensitive, and users may not realize their session content is being persisted or processed by another component.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: When the health check fails, the code automatically starts a detached background server with no explicit notice or consent at the point of use. This is dangerous because it changes host state, leaves a persistent process running, and may surprise users or higher-level agents that only intended to compute memory context.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script starts a background server with nohup and redirects output silently, providing no interactive notice or consent at the time of execution. In an agent skill context, silent background execution is risky because users may not realize a persistent local service has been created or that later agent activity will depend on it.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The function automatically extracts user conversation content and persists derived data such as active projects, working questions, and agent state to a predictable local file under the user's home directory without any visible consent, disclosure, or retention controls. Even though it does not dump the full transcript, it stores user-provided questions and inferred project/activity metadata, which can expose sensitive topics, business context, or personal information to other local users, backup systems, or later compromise of the host.

VirusTotal

67/67 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: examples/session-start/nodejs-agent.js:49

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: smart-memory/index.js:158

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: smart-memory/postinstall.js:14

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: smart-memory/index.js:11