Shared Memory

• Outcome: Pass
• Latest audit: Jul 23, 2026 · 1:13 AM UTC
• Version: 1.1.2

Overview

This skill openly sets up local shared memory conventions for agents and does not show hidden network access, destructive behavior, or credential handling.

Install this only if you want agents to keep and reuse local project memory across sessions and worktrees. Review what gets written to .agents/memory because it may enter git, and avoid storing credentials, tokens, .env content, or sensitive private details in shared layers.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a mismatch because the description presents a full shared-memory read/write system with two layers: durable knowledge in .agents/memory and runtime coordination in .trellis/shared. The actual code only performs setup for the runtime shared layer by locating the Git common directory, creating trellis-shared subdirectories, and linking .trellis/shared to it. It does not read memory, write memory entries, manage .agents/memory, or provide a private local layer. While the symlink setup is related to part of the stated purpose, the implemented behavior is materially narrower than the declared functionality.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest trigger list includes generic phrases such as "shared memory" and "global memory" without narrowing context or exclusion conditions. These phrases could appear in ordinary discussion and may cause unintended invocation because the file does not define when the skill should or should not activate.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: "shared-memory"
description: "Read and write shared state for ANY AI agent with a dual-layer model: durable cross-agent knowledge (`.agents/memory` + optional private local layer) and real-time cross-worktree runtime memory (`.trellis/shared` symlinked to `<git-common-dir>/trellis-shared`). Use for project memory, handoffs, and multi-worktree coordination."
license: "MIT"
allowed-tools: "Bash, Read, Write, Edit, Glob, Grep"
metadata: {"version":"1.1.2","category":"cross-agent-coordination","triggers":["save to shared memory","remember this for all agents","shared memory","global memory","cross-agent memory","worktree shared memory","cross-worktree handoff","agent shared state"],"license":"MIT","tags":["shared-memory","cross-agent-coordination","project-memory","worktree","handoff"],"hermes":{"tags":["shared-memory","cross-agent-coordination","project-memory","worktree","handoff"]}}

• Confidence: 60% confidence
• Finding: write shared state for ANY AI agent with a dual-layer model: durable cross-agent knowledge (`.agents/memory` + optional private local layer) and real-time cross-worktree runtime memory (`.trellis/shar

Session Persistence

Medium

• Category: Rogue Agent

Content

Read indexes first, then load specific files on demand.

## Operation 2 — Write durable memory (K1/K2)

Classify each write as:
- `global` -> K0 (`~/.shared-memory/global`) for machine-wide private lessons

• Confidence: 60% confidence
• Finding: Write durable memory (K1/K2) Classify each write as: - `global` -> K0 (`~/.shared-memory/global`) for machine-wide private lessons - `shared` -> K1 (`.agents/memory`) and enters git - `private` -> K2

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.