mnemosyne

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:05 AM UTC
• Version: 1.0.0

Overview

The skill’s memory purpose is coherent, but installation and persistence are broad enough that users should review it before installing.

Install only after reviewing the upstream repository and installer at a pinned commit. Expect it to persist conversation-derived memory locally, alter agent instruction files, configure Hermes-related paths or hooks, and run a local Web UI; avoid storing secrets or sensitive records unless you have a clear way to inspect and erase them.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:20

Finding

Unpinned Remote Repository Is Cloned and Its Installer Is Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–25
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable code:

bash

git clone https://github.com/ElonAug7/Mnemosyne-agentmemory-engine-openclaw-hermes
cd Mnemosyne-agentmemory-engine-openclaw-hermes/Mnemosyne-v6.4
bash install.sh

The documentation further states:

text

Installer auto-injects the memory protocol into SOUL.md / AGENTS.md and serves a Web UI at http://127.0.0.1:8765.

Technical Analysis

The installation procedure clones the current state of a remote Git repository and immediately executes install.sh. It does not pin the checkout to a reviewed commit hash or release artifact, nor does it require signature or checksum verification.

Consequently, the code executed by users can differ from the code that existed when this skill was reviewed. The remote repository owner—or an attacker who compromises the repository, its account, or its distribution path—can alter install.sh or files invoked by it after publication. Running the documented command would then execute that changed payload with the privileges of the user running the installer.

The declared behavior also includes modifying persistent agent instruction files (SOUL.md and AGENTS.md). This increases the impact of a remote payload because installer-controlled instructions may continue affecting later agent sessions. However, the installer itself is not present in the audited project, so its exact implementation and any additional behavior cannot be verified from this artifact.

Attack Path

1. A user follows the installation instructions in SKILL.md.
2. The user clones the repository without selecting a fixed, previously reviewed commit.
3. Before installation, an attacker compromises the upstream repository or an authorized maintainer publishes a modified installer.
4. bash install.sh executes the altered re ...[truncated 1113 chars]

Remediation

View remediation

Remediation Suggestions

• Pin installation to a specific, reviewed commit hash rather than the remote repository's current default branch.
• Publish versioned, immutable release artifacts and provide a cryptographic SHA-256 or stronger checksum through an independent trusted channel.
• Prefer signed Git tags or release artifacts and require signature verification before execution.
• Avoid piping or immediately executing newly downloaded code. Separate retrieval, verification, review, and execution into explicit steps.
• Include the complete installer and all invoked scripts in the skill package so they can be audited together with the documentation.
• Display and obtain explicit consent before modifying SOUL.md, AGENTS.md, or other persistent agent state.
• Back up persistent instruction files before modification and provide a documented uninstall and rollback process.
• Run installation with the least-privileged account possible; explicitly warn users not to invoke it with sudo or as root.
• Document every file modified, process started, network listener opened, and scheduled or persistent mechanism installed.
• Bind the Web UI only to loopback, require authentication where sensitive memory is exposed, and disable it by default unless needed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation guidance is overly broad: it suggests using the skill whenever the agent needs recall of facts, preferences, decisions, conversation history, or when a user merely asks 'do you remember X'. In an agent ecosystem, such broad triggers can cause the skill to activate in many ordinary conversations and persist sensitive data without clear scoping or consent boundaries, increasing the chance of unnecessary collection and retention of personal information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill advertises persistent storage of user facts, preferences, decisions, and conversation history, but does not provide an explicit warning that this data will be written to local disk and retained across sessions. This creates a meaningful privacy and consent risk because users may disclose sensitive personal or business information without realizing it is being durably stored and later surfaced.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file instructs the user to run a shell installer and describes automatic changes including skill auto-installation, absolute path replacement, and environment variable setup. The description does not include any warning that the command will execute a script and alter the local Hermes skills configuration and environment-related behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.