Security audit

Sophie Mem0

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent memory tool, but it automatically stores personal conversation details and its privacy claim of no third-party data transfer conflicts with its configured remote AI APIs.

Review this carefully before installing. Use it only if users have explicitly agreed that selected conversation details may be stored long term and processed by the configured LLM and embedding providers. Prefer pinned dependencies and Docker images, remove raw conversation metadata storage, avoid printing API-key prefixes, and add clear review/delete controls before enabling automatic memory capture.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:27
Finding: Unpinned Third-Party Dependencies Create a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation
--hash=sha256: qdrant-client== --hash=sha256: ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/auto_memory.py:183
Finding: Privacy Documentation Contradicts Remote Processing of Automatically Collected Personal Data
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/mem0_cli.py:200
Finding: Health Check Reveals an API-Key Prefix
Content: View full analysis
10: checks.append(("API Key", True, f"已配置 ({api_key[:8]}...)")) else: checks.append(("API Key", False, "未配置")) ``` ### Technical Analysis The health command prints the first eight characters of the configured LLM API key. Although this is not enough to authenticate by itself, secret prefixes should not be exposed because command output is commonly retained in shell logs, CI output, monitoring systems, screenshots, and support transcripts. A key prefix can identify or correlate a credential, reveal the provider or key format, and reduce the unknown search space if the remaining credential material is exposed through another weakness. There is no operational need to print any portion of the key to verify that it is configured. ### Attack Path 1. An operator runs the `health` command. 2. The command reads the API key from `mem0_config.json`. 3. The first eight characters are printed to standard output. 4. The output is captured in a CI log, monitoring record, terminal transcript, screenshot, or support message. 5. A person with access to that output obtains the credential prefix and may use it to correlate the key with information from another disclosure. ### Impact Assessment This finding discloses only a prefix and does not independently permit API authentication or local privilege escalation. Its direct impact is therefore low. The affected scope is the configured LLM API credential. Risk increases if logs are broadly accessible or if another vulnerability reveals the remaining key material. ]]>
Remediation: View remediation
10: checks.append(("API Key", True, "configured")) else: checks.append(("API Key", False, "not configured")) ``` ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (16)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill promotes a fully automatic mode but does not clearly warn that conversation content may be retained as long-term memory and sent to external model APIs for processing. This undermines informed consent and can expose sensitive user content to both persistent storage and third-party services without clear notice.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The automatic activation rules are broad everyday phrases like '我叫...', '我喜欢...', and '记得...', which can trigger long-term storage during normal conversation without meaningful user intent confirmation. In a memory skill, this greatly increases the chance of silently collecting personal data, preferences, corrections, commitments, and emotional state at scale.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The documentation claims there is 'no third-party data transmission', but the configuration and architecture clearly send content to external LLM and embedding APIs such as 智谱AI or OpenAI. This is dangerous because users and operators may rely on a false privacy guarantee while sensitive conversation-derived memory is actually transmitted off-host.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The stored metadata includes a raw_text slice of the original conversation, which can preserve far more private information than the extracted memory itself. This expands exposure in case of unauthorized access, logging, downstream processing, or retention beyond what is necessary for the feature to function.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script automatically persists conversation-derived personal information to long-term memory without any consent, notice, or confirmation step. In this context, the data includes identity, preferences, habits, work, location, plans, and emotional state, so silent storage creates a meaningful privacy and compliance risk and can retain sensitive disclosures the user did not intend to save.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill's user-facing instructions and examples are presented entirely in Chinese, which effectively imposes a specific language on users. There is no indication that users can choose another language or that the language restriction is intentional and justified for a region-specific use case.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 84% confidence
Finding: The Docker command references the qdrant/qdrant image without a version tag or digest, so future pulls may retrieve a changed or compromised image unexpectedly. In an agent skill intended for persistent memory storage, this creates supply-chain and reproducibility risk because the deployed database version is uncontrolled.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documented automatic long-term memory capture explicitly targets personal information, preferences, reminders, corrections, and emotional state in plain language. In context, this is more dangerous because the skill is designed for cross-session persistence, making overshared or misdetected sensitive information durable and searchable over time.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The natural-language strings in the skill description and command help are presented only in Chinese, indicating a locale-specific interaction model without any opt-in or alternative language choice. Under the policy, language constraints should either be user-selectable or explicitly documented as justified for a region-specific tool.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill is explicitly designed for automatic monitoring of conversations and persistent retention of extracted user information. That creates a privacy-risking data collection behavior by default, especially because ordinary chat may contain personal data the user did not expect to be archived.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The regex triggers target broad personal and potentially sensitive categories, including name, age, profession, location, habits, plans, corrections, work facts, and emotional state. Combined with automatic extraction from free-form chat, this materially increases the chance of over-collection, misclassification, and persistent storage of sensitive user disclosures.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Natural-language strings throughout the file, beginning with the module description, are fixed to Chinese and the CLI provides no language or locale selection. That creates a language policy concern because users are not offered an opt-in or alternative locale.
Content: No source excerpt is available for this finding.

Internal Network Request

Medium

Category: Server-Side Request Forgery
Confidence: 70% confidence
Finding: Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.
Content: Scanner excerpt · scripts/mem0_cli.py (reported line 185)May include surrounding context.
python
# 2. 检查 Qdrant 连接 try: import requests resp = requests.get("http://localhost:6333/readyz", timeout=5) if resp.status_code == 200: checks.append(("Qdrant", True, "OK")) else:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The health check prints the first 8 characters of the configured API key, unnecessarily disclosing secret material to anyone who can run the command or view its output, logs, or terminal history. Even partial secret exposure weakens confidentiality and can aid credential identification, correlation across systems, or targeted abuse.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest description is written entirely in Chinese, which indicates a language-specific presentation without any accompanying note that the skill is region-specific or offers language choice. Under the policy, language or locale constraints should be opt-in or clearly justified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The cmd_health docstring and CLI help describe this command only as a health check, but its implementation also loads the local config and prints a masked prefix of the configured API key. This is not merely an implementation detail because it surfaces credential-related data to output while the documentation gives no indication of that behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.