T08 · Insecure Dependencies
Warning
- Location
SKILL.md:45- Finding
Unpinned Third-Party SDK Installation Creates a Mutable Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
CogniMemo Memory
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed external memory integration, but it needs Review because it can persist broad user and conversation context without strong opt-in, scoping, or mandatory permission checks.
Install only if you intentionally want CogniMemo to store reusable memory outside the current session. Use a least-privileged environment, pin SDK versions, avoid storing secrets or highly sensitive personal data, require explicit opt-in before any automatic capture, and enforce permission checks in the integration rather than relying on examples or caller discipline.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:234- Finding
External Memory Storage Example Does Not Enforce Permission Checks Before Capturing User Data
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
)
text ### Delete Memory ```python # Delete specific memory
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill demonstrates network access and use of environment-based secrets but does not declare any tool scope or allowed-tools restrictions. In an agent ecosystem, this creates an authorization gap where a memory skill may perform outbound API calls and read API keys without explicit permission boundaries, increasing the chance of unintended data exfiltration or overbroad execution.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger list includes broad phrases like "persistent memory," "ai memory," and "remember across sessions," which are generic enough to match ordinary user requests. This can cause the skill to activate unexpectedly and begin handling or storing sensitive context when the user did not specifically intend to use this external memory provider.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill emphasizes convenience and auto-capture but does not prominently warn that conversations, documents, decisions, tasks, and user actions may be persisted in an external service. Because the skill is specifically designed to collect and retain cross-session data, inadequate disclosure materially increases privacy and consent risk.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md - **Website**: https://cognimemo.com - **Documentation**: https://docs.cognimemo.com - **API Reference**: https://api.cognimemo.com/docs - **GitHub**: https://github.com/cognimemo/sdk ## Error Handling
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The module and class docstrings present this as a 'Memory Manager' for persistent memory using CogniMemo, yet even when an API key is supplied the code forces
self._use_mock = Trueand never initializes a real backend client. This contradicts the documented intent of providing persistent CogniMemo-backed memory operations.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code stores user-provided content, preferences, decisions, tasks, and facts in persistent memory, which can affect user privacy and data handling. While the methods have technical docstrings and a success print, they do not disclose to the user that personal information may be retained or sent to an external memory service in production.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The search method docstring says it will 'Search memories semantically', but the code only lowercases the query and performs a direct substring check against stored content. This is an active contradiction between the documented behavior and the implemented behavior, not merely an omitted detail.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The demo stores "Prefers Portuguese language" as a preference in code, which models forcing a specific language setting without showing user choice or opt-in. Under the language/locale policy, language constraints should be user-selected or clearly offered as an option.
- Content
Static analysis
No suspicious patterns detected.