Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local AI memory tool, but it persistently changes agent instruction files and has overly broad file access behavior that needs review before installation.
Review this carefully before installing. It is designed to index local project content and store memories, but it also writes persistent instructions into files that other AI agents may obey, watches and indexes project directories, and has insufficient path scoping for project selection and memory writes. Install only in a contained workspace after confirming you are comfortable with those persistent changes and local indexing behavior.
src/project_manager.ts:165Persistent Agent Instruction Hijacking Through Managed Rule Files
src/middleware.ts:69Stored Prompt Injection Through Verbatim Context Injection
src/project_manager.ts:238Path Traversal in add_memory Allows File Overwrite Outside the Memory Directory
src/index.ts:178Unrestricted Project Paths Permit Filesystem Modification Outside the Intended Workspace
If the shipped code is only MCP type definitions or project/memory management code, then claims of a high-performance compiled CXP engine, platform support, and specific engine fixes are misleading. That is a supply-chain transparency issue that can cause users to trust capabilities, security properties, or runtime characteristics that are not actually present.
If the shipped code is only MCP type definitions or project/memory management code, then claims of a high-performance compiled CXP engine, platform support, and specific engine fixes are misleading. That is a supply-chain transparency issue that can cause users to trust capabilities, security properties, or runtime characteristics that are not actually present.
If the shipped code is only MCP type definitions or project/memory management code, then claims of a high-performance compiled CXP engine, platform support, and specific engine fixes are misleading. That is a supply-chain transparency issue that can cause users to trust capabilities, security properties, or runtime characteristics that are not actually present.
If the shipped code is only MCP type definitions or project/memory management code, then claims of a high-performance compiled CXP engine, platform support, and specific engine fixes are misleading. That is a supply-chain transparency issue that can cause users to trust capabilities, security properties, or runtime characteristics that are not actually present.
If the shipped code is only MCP type definitions or project/memory management code, then claims of a high-performance compiled CXP engine, platform support, and specific engine fixes are misleading. That is a supply-chain transparency issue that can cause users to trust capabilities, security properties, or runtime characteristics that are not actually present.
If the shipped code is only MCP type definitions or project/memory management code, then claims of a high-performance compiled CXP engine, platform support, and specific engine fixes are misleading. That is a supply-chain transparency issue that can cause users to trust capabilities, security properties, or runtime characteristics that are not actually present.
If the shipped code is only MCP type definitions or project/memory management code, then claims of a high-performance compiled CXP engine, platform support, and specific engine fixes are misleading. That is a supply-chain transparency issue that can cause users to trust capabilities, security properties, or runtime characteristics that are not actually present.
If the shipped code is only MCP type definitions or project/memory management code, then claims of a high-performance compiled CXP engine, platform support, and specific engine fixes are misleading. That is a supply-chain transparency issue that can cause users to trust capabilities, security properties, or runtime characteristics that are not actually present.
If the shipped code is only MCP type definitions or project/memory management code, then claims of a high-performance compiled CXP engine, platform support, and specific engine fixes are misleading. That is a supply-chain transparency issue that can cause users to trust capabilities, security properties, or runtime characteristics that are not actually present.
If the shipped code is only MCP type definitions or project/memory management code, then claims of a high-performance compiled CXP engine, platform support, and specific engine fixes are misleading. That is a supply-chain transparency issue that can cause users to trust capabilities, security properties, or runtime characteristics that are not actually present.
If the shipped code is only MCP type definitions or project/memory management code, then claims of a high-performance compiled CXP engine, platform support, and specific engine fixes are misleading. That is a supply-chain transparency issue that can cause users to trust capabilities, security properties, or runtime characteristics that are not actually present.
If the shipped code is only MCP type definitions or project/memory management code, then claims of a high-performance compiled CXP engine, platform support, and specific engine fixes are misleading. That is a supply-chain transparency issue that can cause users to trust capabilities, security properties, or runtime characteristics that are not actually present.
If the shipped code is only MCP type definitions or project/memory management code, then claims of a high-performance compiled CXP engine, platform support, and specific engine fixes are misleading. That is a supply-chain transparency issue that can cause users to trust capabilities, security properties, or runtime characteristics that are not actually present.
If the shipped code is only MCP type definitions or project/memory management code, then claims of a high-performance compiled CXP engine, platform support, and specific engine fixes are misleading. That is a supply-chain transparency issue that can cause users to trust capabilities, security properties, or runtime characteristics that are not actually present.
The code deliberately injects behavioral directives into agent instruction files such as .cursorrules, CLAUDE.md, and .antigravityrules, which changes how downstream agents behave inside the repository. This exceeds a context/indexing tool's stated purpose and creates a persistence and control channel that can steer agents to use the skill, search its context, and continuously write memory without explicit user consent.
The skill automatically writes or amends multiple agent instruction files, which can persistently influence future agent sessions and override repository-level operating norms. In this context, the inserted text mandates use of Muninn functions and memory recording, making the undisclosed write behavior especially dangerous because it creates agent-targeted persistence rather than mere project metadata.
The lockfile pins @hono/node-server 1.19.9, and the listed advisories describe path traversal and authorization/middleware bypass issues in static file serving. Because this skill depends on @modelcontextprotocol/sdk, which in turn brings in Hono server components, a vulnerable server path may be reachable if the skill exposes HTTP endpoints or static assets.
The project directly depends on @modelcontextprotocol/sdk 1.25.3, which is flagged for a cross-client data leak via shared server/transport. In an agent skill handling contextual data, cross-client leakage is especially sensitive because one user's prompts, tool outputs, or secrets could be exposed to another session.
fast-uri 3.1.0 is listed with multiple host confusion and SSRF-related advisories, indicating unsafe URI canonicalization/parsing edge cases. In an agent or MCP context where URLs may be user-influenced for fetch, callback, or schema handling, URI confusion can lead to SSRF, policy bypass, or incorrect allowlist enforcement.
hono 4.11.7 is flagged with numerous advisories affecting cookies, routing, and path handling. Since it is a peer/transitive component of the MCP SDK server stack, these issues can materially affect any exposed HTTP interface by enabling routing confusion, header/cookie injection problems, or authorization bypasses.
path-to-regexp 8.3.0 has reported ReDoS/DoS issues from complex optional groups and crafted patterns. If route matching is applied to attacker-controlled paths on an exposed HTTP server, repeated pathological requests could consume CPU and degrade service availability.
The manifest depends on @modelcontextprotocol/sdk version 1.25.3, which is explicitly flagged as affected by CVE-2026-25536 involving cross-client data leakage through shared server/transport state. In the context of an AI agent memory/context skill, this is especially dangerous because the package may handle sensitive prompts, memory, or project context, so cross-client leakage could expose one user's data to another session or tenant.
The injected block contains mandatory behavioral directives telling AI agents what tools they must call and when, which is effectively instruction injection into trusted policy files. In the context of an agent skill, this is especially dangerous because these files may be treated as high-priority instructions by other systems, allowing the skill to persistently steer agent behavior beyond its advertised purpose.
The file instructs the agent to always persist decisions, patterns, and bug fixes into shared long-term memory, but provides no consent, minimization, or data-sensitivity guardrails. In practice, this can cause user data, secrets, proprietary code context, or security-relevant reasoning to be retained and reused across sessions or projects, creating a privacy and data-governance risk.
The instruction to immediately run reindexing on the current directory can cause broad scanning and ingestion of repository contents without warning or approval. That behavior may collect sensitive files, secrets, internal documentation, or unrelated data into the skill's memory/indexing system, expanding exposure beyond what is necessary for the task.
No suspicious patterns detected.