Memphis

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:15 AM UTC
• Version: 3.0.0

Overview

Memphis is a coherent AI memory skill, but it needs Review because it stores broad persistent memories and secrets while also enabling network sharing and auto-journaling with limited privacy guidance.

Review this skill carefully before installing in any sensitive workspace. Avoid journaling secrets, personal data, customer data, private repositories, or proprietary documents unless you have verified storage, retention, redaction, and sharing controls. Treat share-sync, IPFS, partner messaging, daemon mode, vault retrieval, and auto_journal as opt-in features that should be disabled or tightly scoped unless explicitly needed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

The documented memphis share command provides a direct mechanism to send content to a network partner, which is an exfiltration primitive in the context of a memory and decision-tracking skill. Even though the example payload is benign, the capability is high risk because the same command could transmit sensitive local memory, project context, or secrets if misused or combined with other features.

Content

Scanner excerpt · SKILL.md (reported line 275)May include surrounding context.

Sync share chain

memphis share-sync

Send message to partner

memphis share "Working on feature X" --type update

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The quick start instructs users to journal free-form content and query it through a provider-backed command without warning that this data may be stored locally and later processed by an LLM provider. In a memory/agent package centered on persistent recall and optional external model providers, users may unintentionally record sensitive data and expose it through later searches, prompts, logs, or provider requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README promotes share-sync, share, and repository/paper ingestion workflows without any warning that these actions may expose sensitive project data, internal decision records, or embedded secrets/PII to other agents or distributed sharing backends such as IPFS. In a skill centered on persistent memory, semantic indexing, and multi-agent synchronization, missing privacy guidance materially increases the chance that users will ingest or publish confidential content under the assumption that the tool is simply 'local-first' and safe by default.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The examples encourage broad journaling of learned information, meetings, and project details into persistent memory chains with no caution around collecting sensitive, personal, or proprietary data. This creates a clear risk of over-collection and long-term retention of information that may later be queried, synced, backed up, or exposed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly documents adding and retrieving secrets from a vault, including example secret material, but provides no warning about secure handling, masking, rotation, access control, or the risks of exposing secrets in shell history, logs, or agent outputs. In an agent skill context, normalizing secret retrieval commands increases the chance that downstream agents or users will handle credentials unsafely.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 255)May include surrounding context.

Backup

bash

# Create backup
memphis backup create ~/backups/memphis-$(date +%Y%m%d).tar.gz

# Restore

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises multi-agent networking, sync, and message sharing features without warning that local memory, decisions, or project information may be transmitted to other systems or agents. In a memory-centric skill, this omission is dangerous because users may assume local-first/privacy-first behavior still applies while data is actually being shared externally.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The configuration enables self-loop and auto_journal behavior, which semantically indicates automatic logging of ongoing interactions or agent activity into persistent storage. Automatic capture materially raises privacy and data leakage risk because sensitive content can be stored without deliberate review or consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.