Security audit

Loci — Memory Palace for AI

Security checks across malware telemetry and agentic risk

Overview

This is a coherent memory skill, but it automatically installs unpinned remote content and silently stores personal memory without clear user controls.

Install only if you intentionally want an always-on local memory system. Before enabling it, review the GitHub repository it clones, confirm you are comfortable with files under ~/loci and ~/.loci, and avoid storing sensitive personal or work information unless you have your own process to inspect, edit, and delete those memory files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill directs the agent to clone a remote Git repository into the user's home directory, modify the cloned repo, and register a persistent path automatically. That gives the skill software installation and filesystem modification behavior beyond simple memory handling, and it occurs without explicit user approval or integrity verification of the downloaded content.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill instructs the agent to read multiple persistent files containing broad personal context at the start of every conversation, regardless of the current request. This creates unnecessary data access and expands exposure of sensitive information far beyond what is needed for many interactions.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The bootstrap section explicitly says the user does not need to do anything and instructs automatic cloning and local file writes. Performing these actions without notice or confirmation violates safe permission boundaries and can surprise users with persistent local state changes.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The skill says factual personal information should be saved silently in the background and also instructs routine reading of personal files, without a meaningful privacy notice or consent boundary. Silent persistence of identity, decisions, tasks, and personal facts materially increases privacy risk because users may disclose information without realizing it will be retained across sessions.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The skill is designed to persist and reuse user personal information across conversations and instructs the agent to load it at conversation start. Without clear consent boundaries, this normalizes long-term profiling and creates a risk of overcollection and inappropriate reuse of sensitive context.

Ssd 3

High

Confidence: 99% confidence
Finding: The instructions explicitly tell the agent to silently save factual personal details, decisions, goals, and lessons into persistent files. This is dangerous because users are not given a timely chance to consent, correct, or withhold sensitive data before it is turned into durable memory and reused later.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.