Security audit

memories.sh CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent memories.sh CLI guide, but its cloud-sync and forced-restore workflows can upload or overwrite broad AI-agent configuration without enough safeguards or warnings.

Review this skill carefully before installing. Prefer a pinned or locally locked CLI version, avoid syncing global/project config directories until you have inspected exactly what will be uploaded, use dry-run/diff/list/show commands first, back up existing AI tool configs before any apply operation, and avoid force-restoring cloud-synced instruction files unless you trust the account and snapshot source.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:16
Finding: Unpinned Third-Party CLI Installation and Execution
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: references/workflows.md:66
Finding: Broad Upload of Global and Project AI Configuration to a Cloud Service
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: references/workflows.md:73
Finding: Forced Cloud Restoration Can Persist Poisoned Agent Instructions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The skill recommends executing npx @memories.sh/cli without pinning a specific package version, which allows the fetched code to vary over time and exposes users to supply-chain risk if a malicious or compromised release is published. In a security-sensitive agent skill, this is especially risky because users may copy-paste the command directly and execute remote code immediately.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The cloud sync and file restoration workflow includes actions like syncing local data, uploading config files, and force-applying global configs, but it does not warn about overwriting local settings, propagating sensitive data, or changing agent/tool behavior across environments. Because this skill is operational guidance for a CLI that manages persistent memory and agent configuration, omission of impact warnings can lead users to perform destructive or privacy-affecting actions without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The semantic search and embedding features are described without warning that memory content may be sent to an embedding provider or external model endpoint. Since memories may contain proprietary or secret data, hidden transmission to an embedding service creates a privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/commands.md (reported line 106)May include surrounding context.
md
**Options:** - `--hard` — Permanent deletion - `-f, --force` — Skip confirmation ### `memories tag <id> <action> [tags]`

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/commands.md (reported line 130)May include surrounding context.
md
**Options:** - `--dry-run` — Preview without writing - `-f, --force` — Overwrite without confirmation **Output Paths:** | Target | File |

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The memories sync command documents cloud synchronization but does not warn users that local memory contents may be transmitted to a remote service. Because this tool handles persistent agent memories that may contain sensitive project data, users could unknowingly exfiltrate code, notes, secrets, or internal instructions to the cloud.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The workflow instructs users to restore global configuration files with a force flag, which can overwrite local user settings without prompting or emphasizing the risk. In a skill specifically used to manage AI tool configs across machines, this is materially dangerous because users may unintentionally replace machine-specific or security-relevant local configuration, causing loss of settings or propagation of unsafe configs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The workflow recommends exporting rules and decisions to YAML and committing them to git without warning that these files may contain sensitive operational facts, internal decisions, or secrets copied into memory entries. In this skill context, memories are a persistent knowledge layer and are likely to store high-value project context, so encouraging direct versioning increases the chance of accidental data exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The authentication documentation explains login/logout behavior but does not disclose that auth credentials or tokens will be stored locally. Users operating on shared machines or regulated environments may make unsafe assumptions about credential persistence and local exposure.
Content: No source excerpt is available for this finding.