Mem0 Memory

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:11 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed memory assistant, but it automatically stores broad conversation content and reuses it across sessions without enough user control or safety boundaries.

Install only if you are comfortable with this skill retaining conversation-derived facts and task state across sessions. Avoid using it with secrets, private URLs, credentials, sensitive business data, or prompt-like instructions unless the implementation adds consent, redaction, review/delete controls, and clear handling for any MiniMax requests.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:72

Finding

Untrusted Conversation Content Is Persisted and Reintroduced Across Sessions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 72-109
Vulnerability Type: Persistent memory poisoning
Risk Level: High

Evidence

The relevant documentation instructs the agent to scan every message and persist broad categories of user-controlled content:

text

WAL trigger scan (required for every message)

Preference       → mem0 add
Experience       → mem0 add
Important fact   → mem0 add
Correction       → SESSION-STATE
Decision         → SESSION-STATE + mem0
Number/date      → SESSION-STATE
URL/path         → SESSION-STATE
Proper noun      → Store after evaluation

Priority: SESSION-STATE over mem0

It then defines the following persistence and recovery workflow:

text

When receiving a message:
  Scan type
    ├─ [preference/experience/fact] → mem0 add
    ├─ [correction/decision/number/URL] → SESSION-STATE.md
    └─ [casual conversation/no value] → do not store
  Reply to the user

After replying:
  Is context utilization above 60 percent?
    └─ Yes → activate WORKING-BUFFER.md

Truncation recovery in the next session:
  1. mem0 get_all → restore long-term semantic memory
  2. mem0 chat → proactively ask whether to continue the previous task
  3. SESSION-STATE.md → restore current task state
  4. WORKING-BUFFER.md → restore conversation from the high-context area

Technical Analysis

The Skill requires automatic processing of every message and directs the agent to store user-controlled facts, corrections, decisions, URLs, file paths, dates, and other data in long-term or session state. The stored information is subsequently restored in future sessions and used by the memory-assisted chat workflow.

No trust boundary is defined between remembered data and agent instructions. There are no requirements to reject instruction-like content, credentials, tokens, malicious URLs, prompt-injection payloads, or other sensitive values before persistenc ...[truncated 1851 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace mandatory automatic storage with explicit, informed user consent for each memory category.
2. Treat all retrieved memories as untrusted data and place them in a clearly delimited user-data section, never in a privileged system-instruction section.
3. Reject or quarantine memories containing imperative instructions, role changes, tool commands, encoded payloads, prompt-control language, or requests to override policy.
4. Do not retain credentials, API keys, authentication tokens, local paths, private URLs, personal identifiers, or other secrets.
5. Add provenance metadata recording the source user, session, creation time, confidence, and validation status of every memory.
6. Enforce strict isolation among users, sessions, and agents. Shared Agent Memory should require an explicit allowlist and authorization check.
7. Apply retention periods, storage quotas, encryption at rest, access controls, audit logging, and reliable deletion.
8. Require user confirmation before restoring old task state or using remembered data to perform tool actions.
9. Sanitize and validate state files before loading them, and provide a safe interface for users to review, edit, and delete retained data.

other

Warning

• Location: SKILL.md:23

Finding

Persisted User Memory May Be Disclosed to an External Language Model

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23-27
Vulnerability Type: Privacy and external data disclosure risk
Risk Level: Medium

Evidence

The documented memory-assisted conversation flow is:

text

The mem0_wrapper.py chat command implements the complete
memory-enhanced conversation flow:

1. Search for relevant memories
2. Inject the memories into the system prompt
3. Call the MiniMax language model to generate a response

The component table at line 13 identifies MiniMax-M2.7 as the language model used for memory generation and extraction. The statement that semantic embedding is completely offline applies to the local Ollama embedder, not explicitly to MiniMax processing.

Technical Analysis

The workflow retrieves retained user information, inserts it into a system prompt, and sends that prompt to MiniMax for response generation. The Skill does not specify whether MiniMax is hosted locally or remotely, what endpoint is used, which data-processing terms apply, or whether sensitive memories are redacted before transmission.

The project contains only SKILL.md, so no executable implementation, endpoint, authentication configuration, or actual network transmission could be verified. The confirmed issue is therefore an unsafe documented data flow rather than evidence of covert exfiltration.

The risk is amplified by the broad memory policy elsewhere in the document, which includes preferences, experiences, personal facts, dates, URLs, and file paths. Retrieved context can consequently contain confidential or personally identifying information unrelated to what is strictly necessary for the current response.

Attack Path

1. User information is retained by the automatic memory workflow.
2. A later chat request performs semantic retrieval over that memory.
3. Matching memories are inserted into the system prompt.
4. The assembled prompt is submitted to MiniMax.
5. If ...[truncated 714 chars]

Remediation

View remediation

Remediation Suggestions

1. Explicitly document whether MiniMax is local or remote, including endpoint ownership, data residency, retention, and model-provider logging policies.
2. Obtain informed user consent before sending remembered information to any external service.
3. Minimize retrieved context and transmit only memories demonstrably necessary for the current request.
4. Add secret detection and redaction for credentials, tokens, personal identifiers, private URLs, local paths, and confidential business information.
5. Provide a fully local language-model option for workflows handling sensitive memory.
6. Use encrypted transport, an approved endpoint allowlist, strict authentication, and auditable outbound-request controls.
7. Keep memories in a delimited untrusted-data section rather than directly incorporating them as authoritative system instructions.
8. Allow users to inspect the exact memory content that will be transmitted and to decline transmission.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The markdown explicitly states '中文记忆提取' and says the system automatically extracts user conversations into Chinese memory entries. This imposes a language/locale behavior on the skill without any opt-in, alternative language support, or region-specific justification, which matches the policy's language/locale violation criteria.

Content

No source excerpt is available for this finding.