Security audit

Cxz9909 Agent Memory

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local agent-memory skill, but it needs Review because it can automatically persist and reuse conversation-derived personal or operational context across sessions without clear consent, trust boundaries, retention limits, or storage protections.

Install only if you are comfortable with an agent keeping local long-term memory. Configure the database location deliberately, avoid storing secrets, credentials, regulated personal data, or untrusted instructions, and add your own approval, review, deletion, and retention process before using the suggested automatic session-start/session-end protocol.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:46
Finding: Persistent Memory Poisoning Through Untrusted Conversation Content
Content: View full analysis
str: """ Store a fact in memory. Args: content: The fact to remember tags: Categories/labels for the fact source: Where this fact came from (conversation, observation, inference) confidence: How confident we are (0-1) expires_in_days: Auto-expire after N days (None = never) Returns: The fact ID """ fact_id = self._generate_id(content) now = self._now() tags = tags or [] expires_at = None if expires_in_days: expires_at = (datetime.utcnow() + timedelta(days=expires_in_days)).isoformat() ``` ```python def learn(self, action: str, context: str, outcome: str, insight: str) -> str: """ Record a lesson learned from experience. Args: action: What was done context: The situation/topic outcome: "positive", "negative", or "neutral" insight: What was learned Returns: Lesson ID """ lesson_id = self._generate_id(f"{action}{context}") conn = sqlite3.connect(self.db_path) ...[truncated 2657 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/memory.py:101
Finding: Sensitive Agent Memory Stored in an Unencrypted Local SQLite Database
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README explicitly promotes persistent storage of user preferences, relationship context, and other potentially sensitive agent memory, but it does not warn users about privacy risks, retention duration, access controls, or the need to avoid storing secrets/PII. In an agent skill, this omission is dangerous because users may enable or integrate it assuming memory is harmless, causing silent long-term accumulation of sensitive data in a local database.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly promotes persistent storage of facts, lessons, and entity data across sessions, but provides no notice about privacy, retention, sensitivity handling, or user consent. In an agent context, this can cause sensitive conversation content or personal data to be silently written to disk and later resurfaced outside the user's expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The session-end workflow instructs the agent to extract durable facts from conversations and store lessons/entity updates, but omits any warning that this may write user content to local persistent storage. This is particularly risky because it operationalizes automatic memory capture, increasing the chance that confidential, regulated, or unexpected personal data will be retained without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This module persistently stores user-provided facts, lessons, and entity data to a SQLite database under the user's home directory by default, but it does not provide any privacy notice, consent mechanism, or visibility into retention/export behavior. In an agent-memory context, this can silently accumulate sensitive personal or organizational information across sessions, increasing privacy and data-handling risk even without an external attacker.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The code exposes permanent deletion operations such as forget and bulk cleanup via forget_stale with no confirmation, soft-delete, recovery window, or audit trail. In a memory-management skill, accidental or unintended invocation can irreversibly remove stored knowledge, including potentially important user data, making this more dangerous because deletion is a core capability likely to be called by higher-level agents.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.