Engram

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:58 AM UTC
• Version: 0.2.0

Overview

This is a local AI memory skill, but it encourages broad persistent recall and raw conversation storage without enough user control or privacy guidance.

Install only if you want an agent to keep local memory across sessions. Avoid storing raw transcripts, credentials, health, financial, client, or proprietary data unless you have explicit reason and a way to review and delete it. Prefer a pinned, reviewed npm version before installing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9
• Finding: Unpinned Third-Party npm Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 9-14 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ```yaml install: - id: node kind: node package: engram-memory bins: ["engram"] label: "Install Engram (npm)" ``` ### Technical Analysis The installation configuration references the third-party npm package `engram-memory` without specifying an exact version or integrity hash. Consequently, installation can resolve mutable package content that was not included in the audited project and may differ between installations. If the package, a package maintainer account, or the npm publishing process is compromised, a malicious release could be selected during installation. npm packages may execute lifecycle scripts during installation, and the installed `engram` executable subsequently runs with the privileges of the invoking user. The project does not provide a lockfile, cryptographic integrity value, vendored source, or other mechanism that binds installation to the specific dependency content reviewed by maintainers. This finding does not establish that the current `engram-memory` package is malicious. It identifies an avoidable supply-chain exposure caused by resolving an unpinned external dependency. ### Attack Path 1. An attacker compromises the `engram-memory` npm package, a maintainer account, or its release pipeline and publishes a malicious version. 2. A user installs the Skill after that release. 3. Because no exact version or integrity hash is specified, the installation process resolves the attacker-controlled package version. 4. Malicious npm lifecycle code may execute during installation, or attacker-controlled logic may execute when the agent invokes the installed `engram` binary. 5. The malicious code operates with the permissions of the installation or execution process and can access resources available to that user. ### Impact Assessment Successful exploitation could perm ...[truncated 507 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `engram-memory` to a reviewed exact version rather than allowing unconstrained resolution. 2. Verify the package against a trusted lockfile and npm integrity hash so installation fails if package content changes. 3. Review the pinned package's source, transitive dependencies, published artifacts, and npm lifecycle scripts before distribution. 4. Disable npm lifecycle scripts during installation where compatible, or explicitly audit every required script. 5. Use an approved registry and enforce package provenance or signature verification in the installation pipeline. 6. Run installation and the resulting CLI under a least-privileged account or sandbox with only the filesystem and memory-store access required for its declared function. 7. Establish dependency monitoring and a controlled update process in which new versions are reviewed before the pin is changed. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: engram
description: "Persistent semantic memory for AI agents — local, fast, free. Use when agent needs to recall past decisions, store new facts/preferences, search conversation history, or maintain context across sessions."
metadata:
  openclaw:
    emoji: "🧠"

• Confidence: 90% confidence
• Finding: Maintaining context across sessions is an intentional feature, but it creates a real session-persistence risk because information from one interaction can influence future ones without fresh user awareness. In a semantic memory tool, that increases the chance of retaining stale, private, or cross-context data and surfacing it later inappropriately.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation guidance is very broad: the skill is framed for recalling past decisions, storing facts/preferences, searching history, and maintaining context across sessions. That breadth can cause an agent to invoke persistent memory in many ordinary conversations, increasing the chance that unnecessary or sensitive user data is stored or queried without clear need or consent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation shows piping raw conversation text directly into persistent storage but does not warn that this may retain sensitive personal, financial, health, credential, or proprietary information across sessions. In a memory skill, omission of this warning makes accidental over-collection and long-term retention much more likely.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The example `echo "Raw conversation text" | engram ingest` explicitly encourages verbatim ingestion of conversations into persistent memory. In this skill's context, that can capture secrets or sensitive user data in plain-language workflows and make it retrievable later through semantic search, broadening exposure beyond the original session.

Static analysis

No suspicious patterns detected.