Security audit

Tiered Recall

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local memory-recall skill, but it can surface private notes and project context into future sessions.

Install only if you want the agent to automatically read local memory files and project context. Review MEMORY.md, memory/, and .tiered-recall before use, and do not store credentials, tokens, client-confidential data, regulated personal data, or other secrets there. Disable or avoid automatic recall in shared-screen, shared-account, or sensitive work contexts.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README explicitly describes automatic loading of core memory, recent logs, and active project files at session start, but provides no privacy notice, consent model, or guidance on limiting sensitive data ingestion. In a memory-management skill, this increases the risk of unintentionally exposing secrets, personal data, or unrelated project context to the model or downstream tools during normal use.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The automatic trigger conditions include broad natural-language cues such as starting a new session or the user mentioning a project name, which can match ordinary conversation unintentionally. That can cause unsolicited loading and summarization of memory files, surfacing sensitive context when the user did not explicitly request recall.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill markets convenience but does not clearly warn that it auto-loads and summarizes memory files, logs, and project data at every new session. This omission undermines informed consent and increases the risk that users will store sensitive information without realizing it will be routinely resurfaced later.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The code loads project key files from disk and includes their contents or previews in JSON output without any consent prompt, redaction, or warning. In a memory/recall skill, those files may contain secrets, proprietary code, credentials, or personal data, so invoking project recall can unintentionally expose sensitive local workspace data to the user, logs, or downstream systems.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The default execution path prints MEMORY.md and recent log contents directly to stdout, only truncating for length rather than sensitivity. Because this skill is specifically designed to aggregate long-term memory and recent activity, it increases the chance of disclosing confidential notes, tokens, internal discussions, or personal information into terminal history, agent transcripts, or other captured outputs.

Ssd 3

Medium

Confidence: 97% confidence
Finding: Automatically loading and summarizing memory/log files on every new session can expose sensitive historical data without a fresh user request or contextual need. Because the feature is designed to run routinely, it normalizes resurfacing prior content and increases the chance of revealing personal, project, or confidential information in the wrong context.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The documented always-loaded core memory includes personal user information, preferences, long-term decisions, and key project records. Persistently loading this class of data by default creates unnecessary exposure and broadens the blast radius if the skill is invoked unintentionally or in a shared/sensitive environment.

Ssd 3

Medium

Confidence: 92% confidence
Finding: The startup example demonstrates automatic disclosure of prior-session activities, active projects, and pending work immediately upon session start. Even when shown back to the same user, this behavior can reveal sensitive history in inappropriate contexts, on shared screens, or when the user expected a clean session.

Static analysis

No suspicious patterns detected.