vector-memory

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:36 AM UTC
• Version: 1.0.0

Overview

This appears to be a real memory-search skill, but it needs Review because it can read more files and run more install/search-time code than its zero-configuration description makes clear.

Install only if you are comfortable with a memory tool that can install npm dependencies, download/cache an embedding model, create a persistent local index of memory files, and run sync commands. Prefer manual installation from reviewed source, avoid the curl-to-bash path, and do not expose this tool to untrusted prompts or users until memory_get path validation and shell command construction are fixed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill documentation presents 'zero configuration' memory search, but the detected capabilities include shell and environment access without any declared permissions. That creates a transparency and trust problem: users and hosting platforms cannot accurately assess or constrain what the skill may do, and shell/env access can expose secrets or enable unintended command execution paths if the implementation is invoked in a privileged environment.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The advertised behavior materially understates what the skill actually does: it performs network downloads, dependency installation, model caching, local persistence of indexed memory, and exposes additional memory-management operations. This is dangerous because users may install a 'search' skill expecting local, low-risk functionality, while the real behavior expands the attack surface to supply-chain risks, unexpected disk persistence of potentially sensitive memory data, and broader operational capabilities than disclosed.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The installer goes beyond placing the skill files by immediately running `npm install` and then executing `node vector_memory_local.js --sync`, which downloads and runs newly installed code. That creates a meaningful supply-chain and execution risk because installation implicitly performs network-dependent package resolution and code execution inside the user's workspace.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The script claims the sync is optional and that the skill works immediately, but the installer always performs `--sync`. This mismatch is dangerous because users may not expect immediate indexing of local memory files during install, reducing informed consent around data processing and side effects.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The README markets the skill as 'zero configuration' while also instructing users to execute shell-based installation and automation steps, including a remote script piped to bash and an auto-sync snippet that runs local commands. In a skill intended for memory/search functionality, these shell instructions expand the trust boundary and can lead users to run unreviewed code or persistent automation they may not fully understand.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The memoryGet function joins a user-supplied path with the workspace root and reads the resulting file without restricting access to the intended memory files. Because path.join does not prevent traversal like '../', callers can read arbitrary workspace-relative files, which exceeds the skill’s advertised memory-search scope and can expose secrets, configs, or source code.

Context-Inappropriate Capability

Low

• Confidence: 81% confidence
• Finding: memoryStatus returns the absolute workspace path even though that detail is not needed for normal memory search functionality. Absolute path disclosure can aid an attacker by revealing filesystem layout and installation details that make follow-on file access or traversal abuse easier.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document explicitly encourages storing contact preferences and personal context in memory files without any warning about sensitive data handling, minimization, or access controls. In a memory/search skill, this is risky because the content is designed to be indexed and retrieved later, which can increase exposure of personal information through search results, syncing, backups, or accidental sharing.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The README instructs users to execute a remote script directly via `curl ... | bash`, which prevents inspection of the downloaded code before execution and creates a straightforward supply-chain execution path if the repository, hosting, DNS, or network path is compromised. In the context of an agent skill meant to be installed and run by users, this is more dangerous than ordinary documentation because it encourages immediate shell execution as part of setup.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The installer writes into the detected workspace, deletes temporary directories, copies files, and runs `npm install` without any confirmation or dry-run mode. For a zero-config installer, this increases the chance of unexpected workspace modification and dependency installation without the user's informed approval.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script fetches code from a remote repository, installs dependencies, and then executes local Node.js code, all without explicit warning that external and newly installed code will run. This is a classic trust-boundary issue: compromise of the repo or dependencies could lead to arbitrary code execution during installation.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Piping a remotely fetched script directly into bash causes arbitrary code from a network source to execute immediately without user inspection, integrity verification, or version pinning. If the remote content, repository, account, or transport path is compromised, users installing the skill can suffer full command execution in their environment.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: memoryGet joins a user-controlled filePath with WORKSPACE and reads the resulting file without validating that the resolved path stays within the workspace. An attacker can potentially use traversal sequences such as '../' to read arbitrary files accessible to the process, exposing secrets or other sensitive local data.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document instructs users to provide an OpenAI API key for embeddings but does not warn that memory content may be transmitted to a third-party service during sync or semantic search. In a memory skill, that data can include sensitive user notes, conversation fragments, or internal knowledge, so omission of a clear disclosure materially increases privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: This is the same underlying issue as the arbitrary-read behavior in memoryGet: the function accepts unchecked workspace-relative paths and reads them directly. In the context of a memory tool, that creates an unexpected file-read primitive that can be abused to access non-memory content without any clear restriction or user awareness.

Missing User Warnings

Low

• Confidence: 76% confidence
• Finding: The skill performs implicit first-run network retrieval of a model dependency without clear pre-execution disclosure at the point of use. In security-sensitive or air-gapped environments, unexpected outbound network access can violate policy, leak metadata such as installation timing/IP, or introduce supply-chain risk if remote artifacts are compromised.

External Script Fetching

Low

• Category: Supply Chain

Content

#!/bin/bash
# One-line installer for Vector Memory
# Usage: curl -sL https://raw.githubusercontent.com/YOUR_USERNAME/vector-memory-openclaw/main/install.sh | bash

set -e

• Confidence: 98% confidence
• Finding: curl -sL https://raw.githubusercontent.com/YOUR_USERNAME/vector-memory-openclaw/main/install.sh | bash

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"main": "vector_memory_local.js",
  "type": "module",
  "dependencies": {
    "@xenova/transformers": "^2.17.2"
  }
}

• Confidence: 92% confidence
• Finding: "@xenova/transformers": "^2.17.2"

Chaining Abuse

High

• Category: Tool Misuse

Content

#!/bin/bash
# One-line installer for Vector Memory
# Usage: curl -sL https://raw.githubusercontent.com/YOUR_USERNAME/vector-memory-openclaw/main/install.sh | bash

set -e

• Confidence: 99% confidence
• Finding: | bash

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: vector-memory/memory.js:23

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: vector-memory/smart_memory.js:97

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: vector-memory/references/pgvector.md:28