Security audit

My Custom Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local memory organizer; its main risk is that it can retain personal information in local files if the user chooses to store or sync it.

Install only if you want a persistent local memory folder. Avoid storing passwords, credentials, government IDs, health or financial details, and sensitive business information unless you have appropriate local protections. Use the built-in-memory sync narrowly and review ~/memory/ periodically for deletion or redaction.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The People template explicitly encourages storing personal contact history, relationship context, communication preferences, and other potentially sensitive personal data, but it provides no privacy guidance, sensitivity labeling, retention limits, access controls, or warning against storing secrets or regulated data. In a memory skill whose purpose is long-term retention and organization, this omission increases the likelihood that users or downstream agents will persist unnecessary personal data in plain markdown files on disk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill explicitly documents copying data from built-in memory into persistent files under ~/memory/sync/ without any caution about secrets, personal data, or user-consent boundaries. That can cause sensitive context from transient or protected memory to be duplicated into broader storage, increasing exposure, retention, and accidental disclosure risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill suggests syncing built-in memory into a separate file-based system, which can duplicate personal data into a broader and more persistent storage surface without informed consent. This increases exposure because information previously held in one context may be copied into local files that are easier to inspect, exfiltrate, or retain indefinitely.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Encouraging transfer of prior built-in memory into a parallel long-term system lacks minimization and consent safeguards, creating a risk of over-collection and unnecessary retention of personal details. In this context, the memory skill is specifically designed for broad accumulation, which makes unchecked replication more dangerous rather than less.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill directs the agent to create persistent storage in ~/memory/ and save user information there, but it does not require any explicit notice that data will be written to local files and retained beyond the current conversation. Users may disclose sensitive personal, professional, or confidential information without understanding the persistence, discoverability, or access risks of that storage.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instruction to immediately store whatever the user wants remembered creates an unrestricted retention channel for secrets, health data, credentials, internal business information, or other sensitive content. Because the skill frames this as 'infinite memory,' it encourages indiscriminate collection and persistence without safeguards, increasing privacy and confidentiality risk.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file states a rule to never modify built-in memory from this skill, but later instructs the agent to read and extract data from the agent's built-in MEMORY.md into ~/memory/sync/. Even though it does not directly overwrite built-in memory, it creates a cross-boundary synchronization path from protected/internal memory into the skill-managed store, which can expose or duplicate sensitive data and blur isolation guarantees.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.