T08 · Insecure Dependencies
Error
- Location
SKILL.md:7- Finding
Unpinned Third-Party Package Creates a Supply-Chain Execution Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
Engram
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent local memory tool, but it encourages persistent storage of credentials and broad conversation ingestion without enough safeguards.
Review this carefully before installing. Do not store passwords, API keys, tokens, regulated personal data, or private client material in this memory store unless you have verified encryption, access control, redaction, retention, and deletion behavior. Pin and audit the npm package before installation, keep the service bound to localhost, and back up memory data before using reset commands.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:51- Finding
Instructions Encourage Persistent Storage of Credentials Without Documented Protection
- Content
View full analysis
- Remediation
View remediation
T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:22- Finding
Automatic Conversation Ingestion and Mandatory Recall Enable Persistent Memory Poisoning
- Content
View full analysis
" --limit 10 ``` Example: `engram search "client onboarding status churn risk" --limit 10` This recalls relevant memories from previous sessions before you start work. ``` ```markdown ## Auto-Extract from Text **Ingest** extracts memories from raw text (rules-based by default, optionally LLM): ```bash # From stdin echo "Mia confirmed client is happy. We decided to upsell SEO." | engram ingest # From command engram extract "Sarah joined as CTO last Tuesday. Prefers async communication." ``` ``` ```markdown ## Best Practices 1. **Boot with recall** — Always `engram search "" --limit 10` at session start 2. **Type everything** — Use correct memory types for better recall ranking 3. **Tag generously** — Tags enable filtering and cross-referencing 4. **Ingest conversations** — Use `engram ingest` after important exchanges 5. **Let decay work** — Don't store trivial facts; let important memories naturally stay salient ``` ### Technical Analysis The skill combines two unsafe behaviors: 1. It recommends ingesting conversation-derived text into durable storage. 2. It mandates searching that persistent storage at the beginning of future sessions. Conversation text may be controlled wholly or partially by an untrusted participant. An attacker can phrase instructions, fabricated decisions, or false facts so that extraction stores them as durable memories. Semantic retrieval can later place that content into an agent's context during an unrelated session. The documentation does not require provenance validation, trust labels, human review, instruction stripping, or a rule that recalled content must be treated solely as untrusted ref ...[truncated 1784 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation encourages recording sensitive user-provided information, including credentials, as durable memory. Since the entire purpose of the skill is persistent recall across sessions, this creates a direct path to storing secrets in a searchable system where they may later be exposed via CLI, API, dashboard, exports, or memory retrieval.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly suggests storing sensitive information such as credentials in persistent memory without any guardrails, redaction guidance, encryption requirements, or access controls. In a memory tool designed to survive sessions and support search/recall, this materially increases the risk of long-term secret exposure through local compromise, accidental retrieval, export, or API access.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
The full delete command permanently removes the SQLite database and vector store backing the memory system. While not malicious, exposing a copy-pasteable force-delete command in documentation for a persistence product is dangerous because it can cause irreversible destruction of user data without validation or recovery steps.
- Content
Want to reset?
bash rm -rf ~/.engram/memories.db ~/.engram/vectors.lance engram serve # rebuilds from scratch
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
The full delete command permanently removes the SQLite database and vector store backing the memory system. While not malicious, exposing a copy-pasteable force-delete command in documentation for a persistence product is dangerous because it can cause irreversible destruction of user data without validation or recovery steps.
- Content
Want to reset?
bash rm -rf ~/.engram/memories.db ~/.engram/vectors.lance engram serve # rebuilds from scratch
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
The full delete command permanently removes the SQLite database and vector store backing the memory system. While not malicious, exposing a copy-pasteable force-delete command in documentation for a persistence product is dangerous because it can cause irreversible destruction of user data without validation or recovery steps.
- Content
Want to reset?
bash rm -rf ~/.engram/memories.db ~/.engram/vectors.lance engram serve # rebuilds from scratch
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The auto-ingest feature persists raw conversational content into long-lived memory but the skill provides no warning about privacy, consent, minimization, or sensitive-data filtering. Because conversational text often contains personal, confidential, or regulated information, automatic extraction and retention can create unbounded privacy leakage and compliance risk.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Add memory curl -X POST http://localhost:3400/api/memories \ -H "Content-Type: application/json" \ -d '{"content": "...", "type": "fact", "tags": ["x","y"]}'
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Advising users to broadly ingest conversations as a best practice promotes indiscriminate persistence of user inputs, which commonly include sensitive personal, business, or security-relevant information. In the context of a semantic memory system, this also makes later retrieval and cross-session propagation of that sensitive content more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The reset section includes a destructive delete command that permanently removes local memory storage files, but it is presented without a clear warning, confirmation step, or backup recommendation. Users may execute it during troubleshooting and irreversibly lose stored memory data, which is especially risky for a persistence-focused product.
- Content
Static analysis
No suspicious patterns detected.