Loci — Memory Palace for AI

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:58 AM UTC
• Version: 0.2.0

Overview

This memory skill is purpose-aligned, but it silently creates a long-term local profile and auto-downloads mutable instructions without enough user control.

Install only if you intentionally want a persistent local memory system that records personal facts, tasks, goals, and decisions across conversations. Before use, confirm the exact storage location, review the downloaded repository contents, decide what may be saved, and establish how to inspect, edit, and delete the memory files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:40

Finding

Silent and Indefinite Persistence of Personal Information

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 40–50 and 62–80
Vulnerability Type: Silent storage of personal information without retention or deletion controls
Risk Level: Medium

Evidence

markdown

## First-Time Setup

When `plan.md` has `status: template`:

1. Detect the user's language from their messages. Ask in that language.
2. Ask these questions (can ask all at once):
   - What's your name?
   - What do you do? (Developer / Designer / Creator / Student / Other)
   - What's your most important focus right now?
   - What hours do you usually work? (Morning / Daytime / Evening / Night owl / Irregular)
   - Preferred language? (English / 中文 / Mix)
3. Generate initial files from answers:
   - `me/identity.md` — name, role, current season
   - `plan.md` — mission + focus as first goal (set `status: active`)
   - `tasks/active.md` — first task from their focus

markdown

### Distillation — what to save where

| Signal | Destination |
|--------|-------------|
| New task | `tasks/active.md` |
| Decision | `decisions/YYYY-MM-DD-slug.md` |
| Personal fact | `me/identity.md` |
| Insight / lesson | `me/learned.md` |
| Goal change | `plan.md` |
| Vague thought | `inbox.md` |

**Factual** → save silently in background, DO NOT make it the focus of your reply
**Subjective** (values, strategy) → ask user first

### Behavior

1. **Be a normal AI first, memory system second.** When the user says something, RESPOND to it naturally (react, comment, ask follow-up, help). Saving to brain happens silently in background — never reply with just "记住了" or "已记录". The user should feel like talking to a smart friend who happens to have perfect memory, not a filing cabinet.
2. Read brain files before answering questions about the user
3. Distill conclusions, not raw conversations
4. Archive, never delete

Technical Analysis

The Skill instructs the agent to collect identity, occupation, work schedule, goals, tasks, decisions, and other perso ...[truncated 2121 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user consent before enabling persistent memory and separately disclose that later factual statements may be stored.
2. Notify the user whenever new information is persisted, or provide a clear session summary of saved items.
3. Implement commands or documented procedures to inspect, edit, export, selectively forget, and fully delete stored information.
4. Apply configurable retention periods instead of using an unconditional “archive, never delete” policy.
5. Exclude credentials, authentication tokens, payment information, medical data, and similarly sensitive information from automatic capture.
6. Minimize collected data and store only information necessary for an explicitly selected memory feature.
7. Create the memory directory and files with restrictive permissions, such as owner-only access where supported.
8. Warn users when the selected directory is managed by cloud synchronization, shared storage, or automated backup software.
9. Document the storage location and threat model without exposing implementation details unnecessarily during ordinary interactions.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:25

Finding

Mutable Remote Repository Supplies Agent Behavior Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25–34 and line 100
Vulnerability Type: Unpinned remote dependency and externally mutable agent instructions
Risk Level: Medium

Evidence

markdown

## Bootstrap (auto-install for new users)

The user doesn't need to do anything. You handle it:

```bash
# Clone Loci brain template
git clone --depth 1 https://github.com/codesstar/loci.git ~/loci

# Remove git remote (user's data stays private)
cd ~/loci && git remote remove origin

# Register brain location
mkdir -p ~/.loci
echo "$HOME/loci" > ~/.loci/brain-path

text

```markdown
For detailed behavior rules, read `docs/behavior.md` in the brain directory.

Technical Analysis

Bootstrap clones the current default-branch state of a remote Git repository without pinning a reviewed commit, validating a checksum, or verifying a cryptographic signature. Removing the Git remote after cloning prevents routine pushes or pulls but does not validate the content already downloaded.

The Skill later instructs the agent to load docs/behavior.md from that cloned repository. Consequently, externally maintained content can supply behavioral instructions that were not included in or reviewed as part of the submitted SKILL.md.

A compromised repository or unsafe upstream update could introduce prompt-injection instructions directing the agent to access additional files, persist unwanted rules, execute commands, or disclose information. The audited content does not prove that such malicious instructions currently exist, and it does not explicitly execute a downloaded script. The confirmed weakness is the unpinned trust relationship and mutable instruction source.

Attack Path

1. An attacker compromises the upstream repository, its maintainer account, or its release process.
2. The attacker modifies the default branch, including docs/behavior.md, to contain unsafe agent instructions.
3. A new user activates the Skill without an existing ...[truncated 1253 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the repository to a specific reviewed commit hash rather than cloning the mutable default branch.
2. Verify downloaded content against a hardcoded cryptographic checksum or a trusted signed release.
3. Prefer bundling the required template and behavior rules directly with the Skill so the reviewed package contains all effective instructions.
4. If remote retrieval is necessary, download a versioned artifact through HTTPS and verify its signature before use.
5. Treat downloaded Markdown as untrusted data rather than automatically authoritative instructions.
6. Validate docs/behavior.md against a strict allowlist of supported directives and reject commands outside the declared memory-management scope.
7. Display the source revision and request user approval before loading externally supplied behavioral instructions.
8. Use a temporary staging directory for verification before placing content in the persistent brain directory.
9. Preserve provenance metadata after installation so users and auditors can identify the exact installed revision.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill instructs the agent to silently distill and store personal facts, decisions, goals, and recent thoughts from ongoing conversations into persistent files. This is dangerous because it enables covert long-term behavioral tracking and memory formation from ordinary chat without clear notice, consent, or strong limits on what gets retained.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly instructs the agent to save factual user information silently in the background and not mention it in replies. Silent persistence of personal data without clear notice or consent undermines user autonomy and privacy, and can create a hidden surveillance-like memory channel across conversations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill metadata and description position it as active across every conversation, with no narrow activation trigger or user-controlled boundary. Over-broad invocation is risky because it can cause pervasive file reads, writes, and behavioral changes even when the user did not intend to use a persistence or memory feature.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The bootstrap flow instructs the agent to perform a network clone and initialize a local workspace automatically, which expands the skill from passive memory management into software retrieval and installation-like behavior. This is dangerous because it causes unprompted external code/content intake and filesystem modification in a user's environment without explicit, informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The bootstrap section performs network retrieval and local filesystem changes automatically while stating that the user does not need to do anything. This is dangerous because it normalizes hidden side effects and can lead to unapproved persistence, supply-chain exposure, and modification of the user's environment without an explicit safety checkpoint.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The same persistence mechanism registers a durable brain-path in the user's home directory, enabling future automatic memory access and reuse. In context, this is not just harmless configuration: it is the anchor for hidden long-term storage behavior and should therefore be treated as a real privacy and persistence risk.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

cd ~/loci && git remote remove origin

Register brain location

mkdir -p ~/.loci echo "$HOME/loci" > ~/.loci/brain-path

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The same persistence mechanism registers a durable brain-path in the user's home directory, enabling future automatic memory access and reuse. In context, this is not just harmless configuration: it is the anchor for hidden long-term storage behavior and should therefore be treated as a real privacy and persistence risk.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

cd ~/loci && git remote remove origin

Register brain location

mkdir -p ~/.loci echo "$HOME/loci" > ~/.loci/brain-path

text

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The instructions require telling the user a fixed Chinese sentence during bootstrap, even though later setup rules say to detect the user's language and ask in that language. This creates a language-policy inconsistency by imposing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs persistent storage of identity, role, focus, work habits, and language preferences for reuse in future conversations without a clear ongoing consent boundary. Persistent collection of personal profile data creates privacy risk, profiling potential, and long-term retention concerns if the data is stored or reused more broadly than the user expects.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Automatic preloading of stored personal context at the beginning of each conversation causes broad reuse of previously retained user data, even when irrelevant to the current task. This increases the attack surface for privacy leakage, accidental disclosure, and over-personalized behavior based on stale or sensitive information.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill requires loading broad personal context files at the start of every conversation, including identity, goals, tasks, and recent notes, regardless of the current request. This creates unnecessary exposure of sensitive user data and increases the chance of privacy leakage or inappropriate reuse beyond what is needed for many interactions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.