Engram

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:59 AM UTC
• Version: 0.2.1

Overview

The skill is a coherent local memory tool, but it encourages persistent storage of credentials and broad conversation ingestion without enough safeguards.

Review this carefully before installing. Do not store passwords, API keys, tokens, regulated personal data, or private client material in this memory store unless you have verified encryption, access control, redaction, retention, and deletion behavior. Pin and audit the npm package before installation, keep the service bound to localhost, and back up memory data before using reset commands.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:7
• Finding: Unpinned Third-Party Package Creates a Supply-Chain Execution Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 7–15 **Vulnerability Type**: Unpinned npm dependency **Risk Level**: High ### Vulnerable Code ```yaml requires: bins: - engram install: npm: engram-memory setup: | # Install Ollama and embedding model brew install ollama # macOS ollama pull nomic-embed-text ``` ### Technical Analysis The skill instructs the environment to install `engram-memory` by package name without specifying an exact version, lockfile integrity value, or verified artifact digest. Consequently, the code installed during separate deployments may differ from the code originally reviewed. npm packages can execute code through lifecycle scripts during installation and through their normal executables at runtime. If the package publisher account, registry entry, release pipeline, or one of the package's transitive dependencies is compromised, a malicious release could execute with the privileges of the user installing or invoking the skill. The project contains only `SKILL.md`; the dependency's implementation and provenance controls were not available for inspection. This finding therefore concerns the unsafe dependency-installation mechanism rather than a confirmed malicious payload in the current package. ### Attack Path 1. An attacker compromises the npm publisher, release process, package registry entry, or a transitive dependency associated with `engram-memory`. 2. The attacker publishes a malicious package version under the expected package name. 3. A user installs the skill after the malicious release becomes the version resolved by npm. 4. The unpinned declaration installs the attacker-controlled version. 5. Malicious lifecycle or runtime code executes under the installing user's account. 6. The payload may access files and credentials available to that account, alter local data, or establish additional unauthorized behavior. ### Impact Assessment Successful exploitation could provide ...[truncated 443 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `engram-memory` to an exact, audited version rather than resolving a mutable latest release. 2. Use a lockfile with registry-provided integrity hashes and verify it in deployment. 3. Verify the npm publisher, source repository, release signatures, and package provenance before installation. 4. Audit direct and transitive dependencies for known vulnerabilities and unexpected lifecycle scripts. 5. Disable npm lifecycle scripts during installation where the package does not require them. 6. Execute the package with a dedicated, least-privileged account or sandbox and restrict filesystem and network access. 7. Establish a controlled update process in which new versions are reviewed and tested before deployment. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:51
• Finding: Instructions Encourage Persistent Storage of Credentials Without Documented Protection<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 51–55 **Vulnerability Type**: Plaintext sensitive-data persistence **Risk Level**: High ### Vulnerable Code ```markdown **When to store:** - Client status changes (churn risk, upsell opportunity, complaints) - Important decisions made about projects/clients - Facts learned during work (credentials, preferences, dates) - Milestones completed (onboarding steps, launches) ``` ### Technical Analysis The skill explicitly identifies credentials as information that should be stored in persistent semantic memory. The documented configuration does not specify encryption at rest, secret detection, credential redaction, per-record authorization, or a secure credential-vault integration. Stored data is accessible through several documented surfaces, including the CLI, REST API, dashboard, MCP tools, and export functionality. Persistence across sessions also extends the period during which a credential may be exposed. The statement that the service is local does not eliminate risks from other local processes, other users with filesystem access, improperly exposed service bindings, backup files, or a compromised account. The supplied project does not contain Engram's implementation, so the precise database protections and file permissions could not be verified. The confirmed weakness in the skill is the unsafe instruction to retain credentials without documenting mandatory safeguards. ### Attack Path 1. An agent encounters a password, API token, access key, or other credential while performing a task. 2. Following the skill's storage guidance, the agent adds that credential to Engram memory. 3. The credential persists under the configured Engram storage path and may also be copied into an export or backup. 4. A malicious or compromised local process, authorized interface user, agent with excessive memory scope, or filesystem-level attacker accesses the stored memory. 5. The attacker extracts the c ...[truncated 522 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Explicitly prohibit storing passwords, access tokens, private keys, session cookies, recovery codes, and similar secrets in Engram. 2. Integrate a dedicated secrets manager and store only opaque references to secret records. 3. Add automatic secret detection and redaction before `add`, `ingest`, `extract`, import, and export operations. 4. Encrypt sensitive memory at rest with keys managed separately from the database. 5. Apply restrictive filesystem permissions and isolate the service under a dedicated operating-system account. 6. Require authentication and authorization for the REST API, dashboard, CLI-mediated access, MCP interface, and exports. 7. Enforce agent- and user-level access controls rather than relying solely on logical scoping claims. 8. Define retention limits, secure deletion procedures, backup protections, and credential-rotation procedures for accidental storage. 9. Require explicit user approval before persisting private or regulated information. ]]>

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:22
• Finding: Automatic Conversation Ingestion and Mandatory Recall Enable Persistent Memory Poisoning<![CDATA[ ## Vulnerability Details **File Locations**: `SKILL.md`, lines 22–29, 85–96, and 220–225 **Vulnerability Type**: Persistent untrusted-content injection **Risk Level**: Medium ### Vulnerable Code ```markdown ## Boot Sequence (MANDATORY) **On every session start**, run: ```bash engram search "<current task context>" --limit 10 ``` Example: `engram search "client onboarding status churn risk" --limit 10` This recalls relevant memories from previous sessions before you start work. ``` ```markdown ## Auto-Extract from Text **Ingest** extracts memories from raw text (rules-based by default, optionally LLM): ```bash # From stdin echo "Mia confirmed client is happy. We decided to upsell SEO." | engram ingest # From command engram extract "Sarah joined as CTO last Tuesday. Prefers async communication." ``` ``` ```markdown ## Best Practices 1. **Boot with recall** — Always `engram search "<context>" --limit 10` at session start 2. **Type everything** — Use correct memory types for better recall ranking 3. **Tag generously** — Tags enable filtering and cross-referencing 4. **Ingest conversations** — Use `engram ingest` after important exchanges 5. **Let decay work** — Don't store trivial facts; let important memories naturally stay salient ``` ### Technical Analysis The skill combines two unsafe behaviors: 1. It recommends ingesting conversation-derived text into durable storage. 2. It mandates searching that persistent storage at the beginning of future sessions. Conversation text may be controlled wholly or partially by an untrusted participant. An attacker can phrase instructions, fabricated decisions, or false facts so that extraction stores them as durable memories. Semantic retrieval can later place that content into an agent's context during an unrelated session. The documentation does not require provenance validation, trust labels, human review, instruction stripping, or a rule that recalled content must be treated solely as untrusted ref ...[truncated 1784 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not automatically ingest complete conversations. Extract only narrowly structured facts after validation. 2. Require explicit user or operator approval before persistent storage of conversation-derived information. 3. Record immutable provenance, author identity, source session, creation time, confidence, and trust level for every memory. 4. Detect and reject instruction-like text, tool directives, policy statements, and requests to override future behavior. 5. Ensure recalled memories are clearly delimited and labeled as untrusted data, never as executable instructions. 6. State explicitly that current system, developer, and user instructions take precedence over all recalled content. 7. Restrict memory creation and retrieval by authenticated agent, user, tenant, and session scope. 8. Provide review, quarantine, revocation, and hard-deletion mechanisms for suspected poisoned memories. 9. Avoid mandatory broad recall at session startup; retrieve only when needed and apply strict relevance and trust filters. 10. Add tests covering cross-session prompt injection, fabricated decisions, poisoned preferences, and malicious content hidden in ordinary conversation text. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Ssd 3

High

• Confidence: 97% confidence
• Finding: The documentation encourages recording sensitive user-provided information, including credentials, as durable memory. Since the entire purpose of the skill is persistent recall across sessions, this creates a direct path to storing secrets in a searchable system where they may later be exposed via CLI, API, dashboard, exports, or memory retrieval.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill explicitly suggests storing sensitive information such as credentials in persistent memory without any guardrails, redaction guidance, encryption requirements, or access controls. In a memory tool designed to survive sessions and support search/recall, this materially increases the risk of long-term secret exposure through local compromise, accidental retrieval, export, or API access.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**Want to reset?**
```bash
rm -rf ~/.engram/memories.db ~/.engram/vectors.lance
engram serve  # rebuilds from scratch
```

• Confidence: 90% confidence
• Finding: The full delete command permanently removes the SQLite database and vector store backing the memory system. While not malicious, exposing a copy-pasteable force-delete command in documentation for a persistence product is dangerous because it can cause irreversible destruction of user data without validation or recovery steps.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**Want to reset?**
```bash
rm -rf ~/.engram/memories.db ~/.engram/vectors.lance
engram serve  # rebuilds from scratch
```

• Confidence: 85% confidence
• Finding: The full delete command permanently removes the SQLite database and vector store backing the memory system. While not malicious, exposing a copy-pasteable force-delete command in documentation for a persistence product is dangerous because it can cause irreversible destruction of user data without validation or recovery steps.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

**Want to reset?**
```bash
rm -rf ~/.engram/memories.db ~/.engram/vectors.lance
engram serve  # rebuilds from scratch
```

• Confidence: 90% confidence
• Finding: The full delete command permanently removes the SQLite database and vector store backing the memory system. While not malicious, exposing a copy-pasteable force-delete command in documentation for a persistence product is dangerous because it can cause irreversible destruction of user data without validation or recovery steps.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The auto-ingest feature persists raw conversational content into long-lived memory but the skill provides no warning about privacy, consent, minimization, or sensitive-data filtering. Because conversational text often contains personal, confidential, or regulated information, automatic extraction and retention can create unbounded privacy leakage and compliance risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Add memory
curl -X POST http://localhost:3400/api/memories \
  -H "Content-Type: application/json" \
  -d '{"content": "...", "type": "fact", "tags": ["x","y"]}'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: Advising users to broadly ingest conversations as a best practice promotes indiscriminate persistence of user inputs, which commonly include sensitive personal, business, or security-relevant information. In the context of a semantic memory system, this also makes later retrieval and cross-session propagation of that sensitive content more likely.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The reset section includes a destructive delete command that permanently removes local memory storage files, but it is presented without a clear warning, confirmation step, or backup recommendation. Users may execute it during troubleshooting and irreversibly lose stored memory data, which is especially risky for a persistence-focused product.

Static analysis

No suspicious patterns detected.