Security audit

sleep-consolidation

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent memory tool, but it needs review because it persistently stores conversation memory and can send session logs to Anthropic without a clear opt-in or review step.

Install only if you want an agent to keep long-term Markdown memories and are comfortable with Claude-backed modes sending session content to Anthropic. Prefer manual runs, review the generated MEMORY.md, daily logs, and bank files, avoid flushing secrets or private enterprise data, and use a constrained workspace until the skill adds consent prompts, redaction, retention controls, and safe path validation.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill clearly performs file reads/writes and references environment-dependent workspace paths, yet declares no permissions or user-visible capability boundaries. This creates a transparency and policy-enforcement gap: hosts or users cannot accurately assess that the skill persists memory to disk and may access local state.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description frames the skill as local memory consolidation, but the body also sends data to Claude for flush/NREM/REM processing and reloads prior logs into the system prompt. That mismatch is security-relevant because users may consent to local storage but not to third-party API transmission or broad resurfacing of prior session content.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The script sends the full daily logs and MEMORY.md contents to Anthropic's external API as part of the prompt payload. These files are likely to contain sensitive agent history, user data, credentials, or internal notes, so exfiltrating them off-host without minimization or explicit consent creates a real confidentiality risk.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The skill's core functionality depends on external network access and a third-party API key, which expands the trust boundary beyond the local workspace. While not inherently malicious, this introduces avoidable privacy, availability, and supply-chain risk for a feature described as memory consolidation over local Markdown files.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger conditions are broad enough to activate on routine conversation states such as long sessions, context pressure, or generic remembering behavior. Overbroad invocation increases the chance that sensitive user data is persisted or sent externally without a deliberate, context-specific decision.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: Phrases like 'sleep', 'remember', or 'process today's learnings' overlap with normal user language and can unintentionally trigger persistence actions. In a memory-writing skill, accidental activation is dangerous because it can silently store private content or propagate it into later prompts.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill omits a clear warning that raw interaction logs and context dumps may be transmitted to Claude and written to persistent storage. That lack of disclosure undermines informed consent and can expose sensitive personal, enterprise, or secret data to both disk retention and third-party processing.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The referenced guidance explicitly recommends persisting durable facts, preferences, key decisions, day-to-day notes, and deep knowledge about people/projects into long-lived Markdown files. That creates a real privacy and data-governance risk because it normalizes retaining potentially sensitive personal and organizational information without any stated consent, minimization, retention limit, access control, or redaction requirements.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: In --flush mode, potentially sensitive session context is sent to Anthropic's external API without any explicit consent gate, redaction step, or warning to the operator. Because this skill is specifically designed to process broad agent memory and session logs, it may disclose secrets, personal data, internal prompts, or proprietary content to a third party.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: At runtime, the code packages today's log and current MEMORY.md into user messages and transmits them to the external API without any user-facing warning, consent, or review step. In this skill context, memory files are specifically intended to accumulate long-term agent knowledge, making silent disclosure especially risky.

Ssd 3

Medium

Confidence: 91% confidence
Finding: The skill instructs the agent to retain broadly defined 'important things' and consolidate experiences without semantic restrictions on secrets, credentials, or sensitive personal data. In a memory system, unrestricted retention materially increases the risk of long-term storage and later resurfacing of data that should be ephemeral.

Ssd 3

High

Confidence: 99% confidence
Finding: The flush mechanism explicitly tells the model to extract durable memories from raw context dumps and write them to disk silently. Silent processing of raw context is particularly dangerous because the dump may contain secrets, personal data, or confidential business information, and the user receives no opportunity to review or veto retention.

Ssd 3

Medium

Confidence: 90% confidence
Finding: Reloading MEMORY.md and recent daily logs into the system prompt broadens the exposure surface of previously stored user data and can cause unrelated sessions to inherit sensitive context. This makes prior retention more dangerous because stored content is not merely archived; it is actively resurfaced into future model context where it may influence outputs or be disclosed.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The skill context makes this more dangerous, not less, because the entire purpose of the skill is long-term memory consolidation across sessions. In that context, instructions to retain user preferences, work history, and interaction history directly increase the chance of building an unbounded dossier on users, coworkers, and projects, which can expose sensitive behavioral patterns or confidential business context if the workspace is accessed or reused improperly.

Ssd 3

Medium

Confidence: 92% confidence
Finding: The system prompt instructs the model to retain long-term facts, decisions, preferences, and observations broadly, without excluding sensitive categories. In a memory-consolidation skill, this creates a substantial risk of durable storage of personal data, secrets, security-relevant context, or other information that should be ephemeral.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The entire context dump, truncated only by length, is wrapped as 'Session context to flush' and submitted for durable extraction without semantic bounds. This makes the skill more dangerous because its purpose is explicitly to compress and preserve memory from broad interaction logs, increasing the chance that sensitive user or system information is extracted and written to persistent markdown files.

Static analysis

No suspicious patterns detected.