Quantum Memory Graph

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:25 AM UTC
• Version: 1.2.0

Overview

The skill matches its memory-tool purpose, but it asks users to install and run an unaudited persistent memory service with network endpoints and little security guidance.

Review this carefully before installing. Use a pinned and verified package version, run it in an isolated environment, keep the service private or authenticated, and avoid storing secrets or sensitive conversations unless retention, deletion, access control, and encryption are clearly handled.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:55

Finding

Unpinned Third-Party Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 55–58
Vulnerability Type: Unpinned and unaudited third-party dependency
Risk Level: Medium

bash

pip install quantum-memory-graph
quantum-memory-graph serve  # serves /store, /recall, /stats endpoints

Technical Analysis

The documented installation command retrieves the latest available quantum-memory-graph release from PyPI without a version constraint, package hash, lockfile, or signature verification. Package installation may execute package-controlled build logic, and the subsequent console command directly executes code supplied by that external package.

The audited project contains only SKILL.md; it does not include the package implementation or dependency manifests. Consequently, the package behavior, transitive dependencies, service authentication, endpoint authorization, data handling, and advertised per-agent isolation cannot be verified from the audited artifact.

The effective code executed by users may change after this Skill has been reviewed. Exploitation requires compromise, replacement, or unexpected modification of the referenced package or one of its transitive dependencies.

Attack Path

1. An attacker compromises the referenced PyPI project, a maintainer account, or a transitive dependency and publishes a malicious release.
2. A user follows the Skill documentation and runs pip install quantum-memory-graph.
3. Because no version or hashes are specified, pip resolves the mutable malicious release or dependency.
4. Package-controlled build or installation behavior may execute during installation.
5. The user runs quantum-memory-graph serve, directly executing the installed package's unaudited entry point.
6. The malicious code operates with the privileges and environment access of the installing or service-running account.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user who i ...[truncated 561 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin quantum-memory-graph to a specifically reviewed version rather than installing the latest release.
2. Pin all transitive dependencies using a lockfile or fully resolved requirements file.
3. Require cryptographic package hashes, such as through pip install --require-hashes.
4. Include or vendor the relevant implementation in the audited project so its installation logic, service endpoints, authentication, authorization, storage, and isolation controls can be reviewed.
5. Verify package provenance and publisher identity, protect release accounts with strong authentication, and use signed or attestable releases where available.
6. Install and run the service in an isolated virtual environment or container under a dedicated least-privileged account.
7. Document endpoint authentication, network binding defaults, access controls, encryption, and memory-retention behavior before exposing the service.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises long-term memory storage and retrieval but does not warn that stored conversations may contain sensitive user, business, or credential data. In an agent ecosystem, this omission can lead operators to deploy persistent memory without appropriate consent, retention, redaction, or access controls, increasing the chance of unintended data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation instructs users to expose /store, /recall, and /stats endpoints without warning that these endpoints provide network access to memory ingestion and retrieval functions. If deployed insecurely, they could enable unauthorized storage, extraction, or profiling of an agent's long-term memory, especially because the skill's purpose is to persist and serve conversation data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.