Security audit

Memory MCP

Security checks for vulnerabilities and agentic risk

Overview

This memory skill is purpose-aligned but needs review because it encourages persistent profiling, conversation retention, and memory sharing without clear consent or privacy controls.

Review this skill carefully before enabling it. It is not showing hidden code execution or exfiltration, but it is designed to persist and reuse personal, emotional, relationship, project, and conversation data across sessions. Only install it if you trust the configured memory MCP server and have clear controls for consent, review, deletion, retention limits, and confirmation before sharing memories with other users.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README explicitly advertises tracking of persona, mood, and learning patterns, which are privacy-sensitive behavioral attributes, but it provides no notice about consent, retention, visibility, or handling boundaries. In a memory/MCP skill, this omission increases the chance that users and integrators enable persistent collection of sensitive profile data without understanding the privacy implications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly promotes persistent storage of conversation data, persona, mood, and cross-session memory without any consent, minimization, retention, or sensitivity guidance. In this context, the skill is designed to normalize broad collection of highly personal data, which increases the risk of privacy violations, over-collection, and later disclosure through recall, context, or sharing features.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation presents the server as exposing 9 tools with specific operations, including memory ops such as mood, persona, and learn, plus workflow examples using cleanup. However, the manifest's only concrete declared interface is the MCP tool dependency list in L011-L020, which names tools but does not evidence those additional operations; the examples therefore actively describe capabilities not supported by the declared interface in this file. This is an intent/documentation contradiction rather than mere incompleteness because the document repeatedly says these operations exist and should be called.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The short-term tool's documented operations are set, get, list, delete, clear, search, but the session-end workflow instructs callers to use { "op": "cleanup", "userId": "u1" }. This actively conflicts with the earlier operation list and could cause callers to invoke a nonexistent operation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documented sharing feature allows memory content to be sent to other users without warning, confirmation, or authorization safeguards in the skill guidance. Because this skill manages persistent conversational and profile-like data, normalizing direct sharing materially raises the risk of accidental disclosure of sensitive personal or project information.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The session workflow instructs the agent to persist conversation content and summaries across sessions as a routine behavior. This creates a plain-language retention and leakage risk because users may disclose secrets, credentials, personal data, or sensitive project details during normal conversation, which could then be recalled, surfaced in context, or shared later.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The best-practice guidance encourages extracting entities from user messages to build persistent knowledge-graph profiles. In a memory skill whose purpose is long-term accumulation and linking, that materially increases the chance of collecting sensitive personal relationships, employers, health, identity, or other profile data that can later be surfaced or disclosed out of context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: Describing proactive reminders and smart suggestions based on memory state implies persistent state and behavior shaping, yet the README does not warn users that prior interactions may influence future outputs or trigger retained reminders. This can lead to unexpected persistence, opaque personalization, and user surprise, especially in an agent memory system designed for cross-session continuity.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file states that every tool call requires userId, but the complete_task example shows { "op": "complete_task", "id": "task_123" } without a userId. That is a direct contradiction between the guidance and the provided usage example.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.