Security audit

Klik Memory Import

Security checks for vulnerabilities and agentic risk

Overview

This skill performs the sensitive import workflow it advertises, with review and confirmation steps before upload.

Install only if you intend to transfer agent memory and scheduled task content to Klik. Review the summary before approving upload, and avoid importing private, proprietary, or regulated information unless you are comfortable storing it in Klik.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill instructs the agent to use native file tools, shell commands, Git, Node, and environment diagnostics, but the manifest does not declare corresponding permissions or capabilities. That creates a transparency and governance gap: users or platforms may not realize the skill can access local files, shell, and environment data while preparing an upload of sensitive memory content.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The description says the skill discovers, reviews, cleans, and securely uploads local memory and tasks, but the underlying CLI behavior reportedly only processes a user-supplied JSON file and also includes additional redaction/diagnostic features not disclosed. This mismatch is dangerous because it can mislead users and reviewers about what actually performs collection, what data is handled, and what extra tooling or network/environment checks may run, reducing informed consent around sensitive data exfiltration.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README explicitly promotes collecting an agent's memory files, user context, project notes, and scheduled tasks, then uploading them to a third-party service, but it does not provide a clear, prominent privacy warning about the sensitivity of that data or the risk of transferring personal, confidential, or proprietary information. Although it mentions secret redaction, that does not cover all sensitive content, so users may be induced to authorize broad exfiltration of data they do not fully understand.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The suggested invocation text is broad enough to blend into ordinary user requests about importing or uploading memory, increasing the chance that an agent auto-installs or runs the skill in response to natural language without a strong trust boundary. In the context of a skill that accesses memory and scheduled tasks, ambiguous triggering increases the risk of unintended collection and transfer of sensitive data.

Known Vulnerable Dependency: esbuild==0.20.0 — 1 advisory(ies): GHSA-67mh-4wv8-2f99 (esbuild enables any website to send any requests to the development server and r)

Low

Category: Supply Chain
Confidence: 89% confidence
Finding: The package declares esbuild 0.20.0, which is associated with a published advisory affecting the development server. Although esbuild is only a devDependency here and this skill ships built artifacts, vulnerable build tooling can still expose developers or CI environments if the dev server is used, so this is a real but limited-risk issue in context.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: test/package.test.ts:28

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: test/redactor.test.ts:12