Integrated Memory Evolution Action

• Outcome: Review
• Latest audit: May 28, 2026 · 7:28 AM UTC
• Version: 1.0.0

Overview

This skill is not malware, but it asks agents to broadly persist user memory and periodically change future agent behavior without clear user controls.

Install only if you intentionally want a workspace-wide persistent memory and self-evolving agent workflow. Before using it, require explicit approval for memory writes, disable scheduled actions by default, exclude secrets/API keys and sensitive personal data, and require reviewed diffs before any changes to AGENTS.md, TOOLS.md, or other files that control future agent behavior.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill defines autonomous daily/weekly flows and explicitly includes updates to operational governance artifacts such as AGENTS.md, TOOLS.md, SESSION-STATE.md, and HEARTBEAT.md without requiring an explicit user-trigger or approval gate. In a skill whose stated role is memory/evolution/action support, this expands into self-directed behavior and policy modification, which can let the agent reshape future behavior, persist unsafe state, or perform unwanted actions outside the user's immediate request.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill instructs the agent to run external Node.js and Python scripts for logging and ontology operations, which introduces arbitrary code-execution capability beyond simple memory handling. If those scripts are modified, untrusted, or environment-dependent, the skill becomes a vehicle for executing local code with the agent's privileges and for making uncontrolled filesystem changes.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The pre-task checklist mandates reading permanent profiles, prior task history, daily conversation logs, and ontology data for every task, then searching memory broadly, without any data-minimization or sensitivity filter. This creates unnecessary exposure of potentially sensitive user information and normalizes access to more data than is required for a given request.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill advertises autonomous crons as part of the core architecture but does not warn users that the system may automatically modify memory and state files. Silent background behavior is risky because users may not realize data is being persisted, transformed, or acted on outside the immediate conversation.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This section instructs every agent to broadly read from and write to shared and permanent memory stores containing user habits, tasks, errors, and conversation history, but it provides no consent, minimization, sensitivity filtering, or retention controls. In a core mandatory skill, that creates a real privacy and cross-context data exposure risk because agents are normalized to access more user data than is necessary for the current task.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The WAL protocol explicitly requires writing conversation content to persistent memory before replying, including preferences, decisions, errors, and supplied information. That is dangerous because it forces automatic persistence of potentially sensitive user data without notice, approval, redaction, or an option to respond without storage.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The daily and weekly automation flows aggregate conversation summaries and promote them into longer-term knowledge, ontology, and operational files without any privacy guardrails or review step. This increases the blast radius of a single sensitive conversation by propagating it across multiple durable stores and scheduled processes.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The WAL protocol requires writing user decisions, preferences, assigned tasks, provided information, errors, and skill usage into persistent memory, often before replying. This creates a broad data-retention surface for natural-language content, increasing the chance of storing secrets, personal data, or sensitive business information that could later be exposed, misused, or retained longer than intended.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The pre-task flow requires routine access to permanent user profile data, prior conversations, task history, learnings, errors, ontology, and state files before acting. That breadth of access increases the chance of exposing unrelated sensitive information to the model and using stale or overbroad context in ways the user did not intend.

Ssd 4

Medium

• Confidence: 92% confidence
• Finding: The skill describes a recurring pipeline that collects conversation summaries, promotes them into event and permanent memory, records learnings/errors/ontology, and periodically reviews and optimizes the system. This cumulative design encourages progressive expansion of retained user data and institutionalizes long-term profiling without clear consent boundaries, retention controls, or deletion guarantees.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: This portion mandates retention of user preferences, tasks, errors, and provided information across shared and permanent memory layers with no clear minimization boundaries or exclusions for sensitive content. Because the skill is positioned as a mandatory core workflow, it encourages systematic over-collection and long-term retention, increasing privacy, compliance, and insider-exposure risk.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The recurring workflows instruct agents to aggregate conversation content and promote it into longer-lived knowledge stores such as learnings, ontology, and operational files. Without review, minimization, or privacy boundaries, this can convert transient user interactions into durable organizational memory and spread sensitive data far beyond the original context.

Static analysis

No suspicious patterns detected.