MEMORIA: Persistent Memory Layer for AI Agents

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:17 AM UTC
• Version: 1.0.2

Overview

This local-memory skill is not malicious, but it needs review because it persistently stores and resurfaces a broad profile of personal, project, and infrastructure context.

Install only if you are comfortable with your agent keeping a long-lived local profile about you and your work. Do not store secrets, credentials, private URLs, IP addresses, regulated data, or sensitive business details; periodically inspect both memory.md and memory.md.bak/archive copies, and treat full summaries as private output in shared terminals or recordings.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

These examples show the agent automatically recalling infrastructure details, prior incidents, and server identifiers across sessions without any warning about sensitive-data resurfacing. That behavior can leak operational details to unintended viewers in shared terminals, recordings, screenshots, or multi-user environments, especially because the recall is proactive rather than user-requested.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The examples normalize storing and re-surfacing detailed personal and infrastructure context in natural language, including server identity, previous incidents, and environment limits. This is dangerous because free-form memory is difficult to sanitize consistently, can include secrets or high-value operational clues, and may be reintroduced into future conversations outside the user's immediate intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example flow explicitly encourages collecting and persisting personal identity, business goals, project names, and technical stack details into a long-lived local memory file, but shows no notice about retention, minimization, or review controls. Even though storage is local, this creates a privacy and oversharing risk because sensitive context can accumulate and later be surfaced unexpectedly to anyone with access to the agent environment or the file.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The initialization sequence encourages broad collection of personal background, revenue goals, project portfolio, and technical infrastructure for indefinite reuse. That creates a natural-language data lake that increases exposure if the local file is accessed, copied, committed, or surfaced by the agent later, and the danger is amplified because users may not appreciate how revealing the aggregate profile becomes over time.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The weekly brief example aggregates historical activities, business progress, decisions, productivity patterns, and blockers into a concise summary. Aggregation increases sensitivity because it turns many small facts into high-value intelligence about the user's business, habits, and priorities, which can be exposed in one response without contextual need-to-know checks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README promotes persistent storage of sensitive personal and project context in a local markdown file but does not clearly warn users about the sensitivity of that data, local compromise risk, or accidental inclusion in backups/repos. Even though storage is local, indefinite retention of identity, preferences, blockers, and project details increases exposure if the file is read by other local users, malware, shell history tooling, or sync/backup systems.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This section explicitly encourages broad, long-term accumulation of highly detailed personal, relational, and project information, creating a rich local dossier that could be misused or overexposed. The skill context makes this more dangerous because its core purpose is comprehensive cross-session memory, so overcollection is not incidental but central to operation and likely to grow over time without minimization boundaries.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Documenting a natural-language command that returns a full memory summary creates a broad disclosure primitive that may surface all accumulated user data with minimal friction. In an agent environment, plain-language triggering raises the risk of accidental disclosure, prompt-influenced disclosure, shoulder surfing, or exposure in shared terminals/logs because no confirmation, scoping, or redaction behavior is described.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The core design instructs the agent to persist broad personal, project, and behavioral information across sessions in a local file. Even without cloud exfiltration, this creates a durable retention channel for sensitive data that can later be exposed through model responses, local compromise, shared accounts, or accidental inclusion in other workflows.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

The skill explicitly creates and relies on a persistent local memory file across sessions, which establishes durable state retention. Persistent storage of conversational context can increase privacy and confidentiality risk because data survives beyond the immediate interaction and may later be surfaced or accessed unexpectedly.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

./memoria.md ← workspace fallback

text

If none exist, create `~/.memoria/memory.md` and run the setup below.

> **Security setup (run once after install):**
> ```bash

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

> **Security setup (run once after install):**
> ```bash
> mkdir -p ~/.memoria
> chmod 700 ~/.memoria
> touch ~/.memoria/memory.md
> chmod 600 ~/.memoria/memory.md
> echo ".memoria/" >> ~/.gitignore

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 259)May include surrounding context.

md

> **Security setup (run once after install):**
> ```bash
> mkdir -p ~/.memoria
> chmod 700 ~/.memoria
> touch ~/.memoria/memory.md
> chmod 600 ~/.memoria/memory.md
> echo ".memoria/" >> ~/.gitignore

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

> mkdir -p ~/.memoria
> chmod 700 ~/.memoria
> touch ~/.memoria/memory.md
> chmod 600 ~/.memoria/memory.md
> echo ".memoria/" >> ~/.gitignore
> echo "memoria.md" >> ~/.gitignore
> ```

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 260)May include surrounding context.

md

> mkdir -p ~/.memoria
> chmod 700 ~/.memoria
> touch ~/.memoria/memory.md
> chmod 600 ~/.memoria/memory.md
> echo ".memoria/" >> ~/.gitignore
> echo "memoria.md" >> ~/.gitignore
> ```

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The startup protocol instructs the agent to read all retained memory every session and immediately surface personalized details. This increases the chance that stale, private, or contextually inappropriate information will be revealed in routine conversation or visible to anyone observing the session.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The update protocol encourages continual accumulation of goals, decisions, blockers, preferences, and lessons learned whenever they appear in conversation. Persistent aggregation of this behavioral and project data can create a detailed profile that is sensitive even if it excludes passwords and tokens.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill relies on broad natural-language intent matching such as 'Remember that...', 'Forget about X', and 'What do you know about me?' to trigger persistence and disclosure actions. In practice, ordinary conversation, quoted text, examples, or prompt-injected content from external sources could accidentally cause writes or data disclosure without a strong confirmation boundary.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The command interface includes a full-memory summary action ('What do you know about me?') that can dump accumulated private data in one response. If triggered unintentionally, socially engineered, or invoked in a shared environment, it creates a concentrated disclosure path for all retained information.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Creating a backup before each write improves integrity, but it also duplicates retained data into an additional persistent artifact. That expands the number of files containing sensitive history and can undermine deletion expectations if users clear the main file but forget the backup copy.

Content

Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.

text

~/.memoria/               ← chmod 700 (owner only)
├── memory.md             ← chmod 600 (primary memory file)
├── memory.md.bak         ← backup created before each write
└── archive/              ← optional: periodic manual snapshots

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The example records communication style as "Direct, Greek or English," which suggests the skill may constrain interactions to specific languages. Under the locale policy, language constraints should be user-selectable or clearly justified; this example does not show that broader language choice is supported.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The trigger is defined as "weekly review" or "Monday morning," but the latter is not a specific user invocation and does not state timezone, locale, or whether synthesis should happen automatically. That ambiguity can cause unintended activation based on time rather than clear user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The initialization flow asks the user to choose between specific languages, shown as "Greek/English," which can impose a language policy rather than offering open language preference. This is a natural-language policy concern because it narrows the interaction language by default instead of clearly letting the user choose any preferred language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.