Security audit

nix-memory

Security checks for vulnerabilities and agentic risk

Overview

The skill’s memory-integrity purpose is coherent, but its installer guidance and quickstart introduce high-impact review concerns around remote shell execution, persistent agent-state changes, and retained copies of private memory files.

Review this before installing. Prefer the local scripts from the reviewed package and do not use the documented curl-to-bash command. Run setup only in a workspace where duplicating identity and memory Markdown files into .nix-memory is acceptable, and inspect or manually edit HEARTBEAT.md if you do not want recurring future execution.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/quickstart.sh:6
Finding: Unverified Remote Script Execution Through curl-to-Bash Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/setup.sh:15
Finding: Plaintext Duplication of Sensitive Identity and Memory Files
Content: View full analysis
> "$LOG" echo "Creating identity baselines..." | tee -a "$LOG" HASHED=0 for f in "${IDENTITY_FILES[@]}"; do fpath="${WORKSPACE}/${f}" if [[ -f "$fpath" ]]; then hash=$(sha256sum "$fpath" | cut -d' ' -f1) echo "${hash} ${f}" >> "${BASELINE_DIR}/identity-hashes.txt" # Store full content snapshot for diff later cp "$fpath" "${BASELINE_DIR}/${f}.baseline" echo " [OK] ${f} -> ${hash:0:16}..." | tee -a "$LOG" HASHED=$((HASHED + 1)) else echo " [SKIP] ${f} not found" | tee -a "$LOG" fi done ``` ### Technical Analysis The setup process calculates SHA-256 hashes but also copies the complete contents of `SOUL.md`, `IDENTITY.md`, `USER.md`, `AGENTS.md`, and `MEMORY.md` into `.nix-memory/baselines`. These files can contain personal context, operational instructions, private memory, and agent identity information. No restrictive `umask`, directory mode, or file mode is configured before creating the copies. Their effective permissions therefore depend on the caller's environment and default umask. Full snapshots are useful for textual drift comparisons, but they exceed the minimum storage required for basic integrity verification, which only requires hashes. They also create additional retained copies that may remain after the original content is removed. ### Attack Path 1. A workspace identity or memory file contains sensitive information. 2. The user runs `setup.sh`, directly or through `quickstart.sh` or `continuity-score.sh`. 3. The script copies the complete file into `.nix-memory/baselines`. 4. The copied file receiv ...[truncated 828 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: scripts/quickstart.sh:224
Finding: Quickstart Permanently Adds Recurring Commands to Agent Heartbeat State
Content: View full analysis
/dev/null; then step "HEARTBEAT.md already has memory checks" return 0 fi local MEMORY_BLOCK=" ## Memory Integrity (every heartbeat) - Run: bash skills/nix-memory/scripts/watch.sh - If NIX_MEMORY_ALERT: run continuity-score.sh and investigate - If NIX_MEMORY_OK: continue normally - Periodically run: bash skills/nix-memory/scripts/drift-detect.sh " if [[ -f "$HB" ]]; then echo "$MEMORY_BLOCK" >> "$HB" step "Appended memory checks to existing HEARTBEAT.md" else echo "# HEARTBEAT.md" > "$HB" echo "$MEMORY_BLOCK" >> "$HB" step "Created HEARTBEAT.md with memory checks" fi } ``` ### Technical Analysis The quickstart installer modifies `HEARTBEAT.md`, a persistent workspace file used to direct future agent behavior. The inserted block instructs future heartbeats to execute Skill scripts repeatedly. Heartbeat integration is related to the advertised functionality and is described in the project documentation. However, the quickstart applies it automatically rather than presenting the exact change and obtaining separate consent. It also provides no managed removal mechanism. This creates recurring execution beyond the initial setup run. If the referenced Skill files are subsequently replaced or compromised, the persistent heartbeat instruction can repeatedly invoke the altered code. ### Attack Path 1. A user runs `scripts/quickstart.sh`. 2. The script appends recurring command instructions to `HEARTBEAT.md`. 3. Future agent sessions load and follow the ...[truncated 928 chars]
Remediation: View remediation
... ``` 5. Provide an uninstall or disable command that removes only the managed block. 6. Resolve and verify the referenced script path before adding persistent instructions. 7. Document that heartbeat integration causes recurring execution across future sessions. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/quickstart.sh:106
Finding: Unescaped Workspace and Argument Data Written to JSON and JSONL
Content: View full analysis
"$AGENT_JSON" << CARD { "version": "1.0", "agent": { "name": "${AGENT_NAME}", "handle": "${AGENT_HANDLE}", "description": "${AGENT_DESC}", "created": "$(date -u +%Y-%m-%dT%H:%M:%SZ)" }, "owner": { "name": "operator" }, "capabilities": [ "memory-persistence", "identity-verification", "drift-detection" ], "memory": { "architecture": "nix-memory-layer", "tools": ["nix-memory", "memory-guard"], "continuity_scoring": true, "drift_detection": true, "tamper_protection": true }, "trust": { "level": "new", "identity_verified": false, "memory_integrity": "unverified" }, "endpoints": { "card": "/.well-known/agent.json" } } CARD # Also place in .well-known for discovery mkdir -p "$WELLKNOWN" cp "$AGENT_JSON" "${WELLKNOWN}/agent.json" ``` The generated decision logger contains the same class of flaw: ```bash DECISION="${1:?Us ...[truncated 2335 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The usage instructions recommend fetching a remote script and piping it directly to bash, which enables arbitrary code execution from a network source with no integrity verification. If the remote host, transport, DNS, or upstream content is compromised, users would immediately execute attacker-controlled shell commands.
Content: Scanner excerpt · scripts/quickstart.sh (reported line 7)May include surrounding context.
sh
# Zero deps. Pure bash. Works everywhere. # # Usage: # curl -sL https://nixus.pro/memory/install.sh | bash # -- or -- # bash skills/nix-memory/scripts/quickstart.sh #

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: Piping curl output directly into bash removes any opportunity for inspection and turns network-delivered content into immediate command execution. In an installer for agent skills, this is especially dangerous because it normalizes unsafe operator behavior and can lead to full workspace or account compromise if the fetched content is tampered with.
Content: Scanner excerpt · scripts/quickstart.sh (reported line 7)May include surrounding context.
sh
# Zero deps. Pure bash. Works everywhere. # # Usage: # curl -sL https://nixus.pro/memory/install.sh | bash # -- or -- # bash skills/nix-memory/scripts/quickstart.sh #

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script automatically runs setup.sh when the expected state directory is missing, which can create or modify files in the workspace without explicit user confirmation. In an agent skill context, implicit filesystem-changing behavior increases risk because initialization may occur as a side effect of a read-like health check, and users may not realize execution will mutate their environment.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · scripts/drift-detect.sh (reported line 149)May include surrounding context.
sh
echo " Last verification: ${LATEST_AGE} hours ago" if [[ $LATEST_AGE -gt 48 ]]; then SCORE=$((SCORE - 10)) echo " WARNING: No verification in ${LATEST_AGE}h - continuity gap" fi fi fi

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The header comments describe this script as an installer that sets up the complete memory architecture and list nix-memory and memory-guard among what it installs. In practice, the code only checks whether those skill directories already exist and, if not, emits warnings and continues, so the documented effect of a complete install is contradicted by the actual behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script executes other shell scripts from the workspace (setup.sh and memory-guard.sh) without verifying integrity, origin, or obtaining confirmation. In this context, the workspace is attacker-influenced input, so a malicious or replaced skill script would execute arbitrary code under the user's account during installation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The installer creates and modifies multiple files in the user's workspace without an approval step, including agent.json, HEARTBEAT.md, and executable helper scripts. In a skill-install context, silent mutation of persistent workspace state is risky because users may run the installer expecting inspection or limited setup, while the script alters future agent behavior and trust-related metadata.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code creates persistent directories and later writes multiple files under the state directory, including logs, manifests, config, and baseline snapshots. Although the script logs what it is doing, it does not provide a user-facing warning before creating persistent local state or copying tracked markdown files into baseline storage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: This block saves a continuity report to a file under the state directory, which is a filesystem write affecting persistent user or workspace data. The write is visible in code, but there is no preceding comment, header warning, or stronger user-facing notice explaining that running the script will store a report on disk.
Content: No source excerpt is available for this finding.