Memphis Cli

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:41 AM UTC
• Version: 2.1.1

Overview

The skill is mostly a Memphis memory CLI guide, but it also documents persistent messaging, external sync, a public shared encryption key, and unverified executable setup in ways users should review carefully before installing.

Review this skill before installing. Do not use the automated messaging or IPFS upgrade steps unless you verify the scripts and binaries yourself, replace the published shared key with unique secrets, understand what Pinata/IPFS will store externally, and have clear commands to stop daemons and clean local queues.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T06 · System Persistence

Error

• Location: SKILL.md:121

Finding

Installation of a Persistent Background Message-Checking Daemon

Content

View full analysis

~/.agent_name # or "memphis" for PC #2 # 2. Create directories mkdir -p messages/{inbox,outbox,processed} pinata_messages # 3. Install auto-check daemon (every 5 min) ./check-messages-daemon.sh --install ./check-messages-daemon.sh --status ``` The document also describes another background collector: ```text memphis daemon start (collector-based background tasks: journaling git diffs, shell history, etc.). ``` ### Technical Analysis The Skill directs the user or agent to install a daemon that executes every five minutes. Installation of a recurring daemon creates cross-session persistence: the process or scheduled task continues operating after the original Skill invocation has completed. The daemon processes externally sourced message metadata and content through the share chain and Pinata workflow. The document does not define an approval boundary, integrity-verification mechanism, restricted execution account, retention policy, or uninstall procedure. It also recommends a separate Memphis daemon capable of collecting Git diffs and shell history, both of which may contain repository secrets, credentials entered on command lines, private paths, or proprietary source changes. Because the referenced daemon scripts are not present in the audited package, their scheduling mechanism, permissions, validation behavior, and data handling cannot be verified. ### Attack Path 1. A user or autonomous agent follows the first-time setup instructions. 2. `check-messages-daemon.sh --install` registers a recurring background task. 3. The task continues to run every five minutes after the original session ends. 4. The daemon checks externally synchronized message sources and downloads message content. 5. Malicious, forged, ...[truncated 861 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:177

Finding

Publicly Embedded Shared Encryption Key

Content

View full analysis

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:263

Finding

Remote Binary Downloaded, Installed, and Executed Without Integrity Verification

Content

View full analysis

> ~/.bashrc # Migrate repo ipfs repo migration --allow-downgrade # Start daemon ipfs daemon & ``` ### Technical Analysis The workflow downloads a remote archive and installs its executable without verifying an official cryptographic checksum or release signature. HTTPS protects the connection in transit but does not protect against a compromised upstream distribution system, malicious replacement at the source, certificate-authority compromise, or an incorrectly published artifact. The downloaded binary is copied into `~/.local/bin`, made executable, placed at the front of `PATH`, and launched as a background daemon. The `.bashrc` modification makes the PATH preference persist in future shell sessions. Consequently, the effective executable payload can differ from the content reviewed in the Skill. The workflow additionally invokes repository migration with `--allow-downgrade`. This can facilitate movement to an older repository format and should not be enabled without a specific compatibility requirement and backup procedure. ### Attack Path 1. An attacker compromises the referenced distribution artifact, release infrastructure, or another trusted part of the delivery path. 2. The user follows the Skill and downloads the substituted archive. 3. No checksum or signature comparison detects the substitution. 4. The archive is extracted, and the attacker-controlled `ipfs` file is copied to `~/.local/bin/ipfs`. 5. The file is marked e ...[truncated 875 chars]

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Warning

• Location: SKILL.md:116

Finding

Execution of Unbundled Relative-Path Automation Scripts

Content

View full analysis

~/.agent_name # or "memphis" for PC #2 # 2. Create directories mkdir -p messages/{inbox,outbox,processed} pinata_messages # 3. Install auto-check daemon (every 5 min) ./check-messages-daemon.sh --install ./check-messages-daemon.sh --status ``` ```bash # To Memphis (PC #2) ./send-message.sh memphis "Task: Train Model C on 50 decisions" # To Watra (PC #1) ./send-message.sh watra "Status: Model C training complete" ``` ```bash # Check manually ./receive-messages.sh # View daemon log ./check-messages-daemon.sh --log ``` The document claims that the following scripts are included: ```text - send-message.sh — Unified sender - receive-messages.sh — Unified receiver - check-messages-daemon.sh — Auto-check daemon - pinata-upload.sh — Helper - pinata-download.sh — Helper ``` However, the audited project contains only `SKILL.md`; none of these scripts are included in the package. ### Technical Analysis The Skill changes into `~/memphis` and executes files through relative paths. These executable files are outside the audited package, and their provenance, ownership, integrity, and behavior are not checked before execution. This creates a local tool-hijacking boundary. Any file with a matching name in `~/memphis` is treated as the trusted messaging implementation. A stale, modified, or attacker-planted script can therefore inherit the trust users place in the Skill. The named scripts are expected to handle encryption keys, Pinata credentials, external uploads and downloads, message plaintext, acknowledgements, and daemon installation. Those capabilities make substitution particularly consequential. ### Attack Path 1. An attacker or compromised process obtains write access to the user's `~/mem ...[truncated 1292 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (12)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The share-sync instructions encourage pulling and pushing data via IPFS/Pinata without a clear warning that content leaves the local system and is handled by third-party infrastructure. In a skill marketed as local-first memory management, omitting explicit disclosure materially increases the risk of unintended data exfiltration or sharing of sensitive memory artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The automated messaging section installs a daemon that periodically uploads, downloads, decrypts, stores, and acknowledges messages through external services, yet it lacks an explicit warning about continuous network activity and local persistence. That combination can silently move sensitive information off-host and create durable local artifacts, which is especially dangerous in an agent skill context.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.

ed

• Protocols: QUIC v1 + WebTransport
• Relay: Full circuit support

Upgrade Guide (if needed)

bash

# Download IPFS 0.27.0
cd /tmp
wget https://dist.ipfs.tech/kubo/v0.27.0/kubo_v0.27.0_linux-amd64.tar.gz

# Install
tar -xzf kubo_v0.27.0_linux-amd64.tar.gz
mkdir -p ~/.local/bin
cp kubo/ipfs ~/.local/bin/
chmod +x ~/.local/bin/ipfs

# Update PATH
export PATH="$HOME/.local/bin:$PATH"
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc

# Migrate repo
ipfs repo migration --allow-downgrade

# Start daemon
ipfs daemon &

---

7. Packaging / Maintenance Tips

• After major updates, document state in journal + optionally memory/YYYY-MM-DD.md.
• Run memphis status before/after large automation runs.
• Keep Ollama models + embeddings up-to-date (re-embed after big ingests).
• When scripting around Memphis, use the JSONL structure (immutable blocks) and hashing rules if writing custom tooling.

Memphis thrives when its chains stay fresh, summaries are updated, and

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description says to 'Use whenever you need to capture or query memory chains, manage providers, or keep the Watra/Style brain in sync,' which is a very broad activation condition rather than a narrowly scoped trigger. Because this is manifest-style text and lacks explicit constraints or negative examples, it could cause unintended invocation for common memory, sync, or troubleshooting tasks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The text says 'Use this when you need to drive the Memphis local-first brain from the terminal' and then 'It covers everything from first-time setup through advanced workflows ... and day-to-day hygiene.' This does not clearly distinguish when the skill should or should not activate, making the trigger scope overly broad for a markdown skill description.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill goes beyond operating a local-first memory CLI and introduces an always-on encrypted messaging subsystem using Pinata/IPFS plus a daemon. That expands the trust boundary to external services and persistent background processes, creating unnecessary attack surface and opportunities for covert data exchange or unauthorized synchronization.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 92% confidence

Finding

The instructions create persistent message queues and install a recurring auto-check daemon, establishing ongoing background behavior and durable state outside the immediate user action. In an agent skill, persistence mechanisms are security-relevant because they can facilitate covert coordination, unsupervised network activity, and accumulation of sensitive message contents.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md

# 1. Set agent identity
echo "watra" > ~/.agent_name  # or "memphis" for PC #2

# 2. Create directories
mkdir -p messages/{inbox,outbox,processed} pinata_messages

# 3. Install auto-check daemon (every 5 min)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The watcher and daemon commands enable automatic collection and ingestion of local activity such as file changes, git diffs, and shell history without clearly warning about background monitoring. Users may unknowingly ingest sensitive data into Memphis chains or trigger secondary processing over private material.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.

md

# Install
tar -xzf kubo_v0.27.0_linux-amd64.tar.gz
mkdir -p ~/.local/bin
cp kubo/ipfs ~/.local/bin/
chmod +x ~/.local/bin/ipfs

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Line L046 states an intent to keep secrets out of environment variables and files, yet the example sets and exports MEMPHIS_VAULT_PASSWORD in the shell environment. That is a direct contradiction between stated security intent and documented practice.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The phrase 'Zero-config agent communication' directly conflicts with the subsequent setup steps and requirements. This is not merely incomplete documentation: the text explicitly claims no configuration while requiring substantial manual configuration and external dependencies.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The example uses a Polish prompt ('Jakie są kolejne kroki Phase 2?') even though the surrounding documentation is in English and there is no stated language-selection behavior or locale justification. This can be read as implicitly steering usage toward a specific language without opt-in.

Content

No source excerpt is available for this finding.