Security audit

Remember When Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent chat-archiving tool, but it asks for broad ongoing access to conversations and media while making an inaccurate local-only privacy claim.

Review this skill carefully before installing. It is not clearly malicious, but it should be treated as a Review case because it can monitor chats, retain summaries and media, inspect history, scan shared media folders, run shell commands, and perform external searches despite a local-only claim. Prefer a pinned release, a pinned and audited CLI, explicit per-group consent, disabled heartbeat/enrichment by default, and clear deletion/export controls.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

Location: README.md:10
Finding: Unpinned Third-Party Installation and Execution
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:115
Finding: Overbroad Persistent Access to Chat History and Media Directories
Content: View full analysis
Remediation: View remediation

other

Warning

Location: SKILL.md:170
Finding: Local-Only Privacy Claim Conflicts with Autonomous External Searches
Content: View full analysis
" -d --weather "" --news "" --historical-events ""` #### 2. Entry Enrichment (entry level) When archiving an `interest_point` or a notable entry, the agent should search for: - **History**: Background or historical information about the place/subject. - **Type**: Classification (monument, restaurant, park, etc.). - **Location**: Geographic description. ``` ### Technical Analysis The absolute assertion that the skill does not contact external servers conflicts with the enrichment workflow, which instructs the agent to autonomously search for weather, news, historical information, and location context using its own tools. Even if the local CLI itself performs no network request, an agent search tool generally transmits a query to an external service. Queries derived from private entries can contain or reveal dates, inferred locations, group topics, visited places, interests, and event context. Delegating the request to another age ...[truncated 1413 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly claims all processing is local and that it does not contact external servers, but later instructs the agent to perform contextual searches for weather, news, and history using its own tools. This contradiction can mislead users and operators into authorizing the skill under false privacy assumptions, causing unexpected data exposure to external services.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation assures users there are no external APIs, yet later operational instructions require the agent to perform external searches through its own tools. This is a material security and privacy misrepresentation that can cause users to expose sensitive conversational context while believing the skill is fully offline.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The persona instructs the agent to listen to all messages and proactively archive material autonomously, which increases the chance of collecting sensitive content without specific user intent. In a chat setting, that can preserve private discussions, personal details, or regulated information beyond what participants expect.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The maintenance workflow tells the agent to re-read group history and infer participants and group details from prior conversations, expanding access to historical data beyond the immediate task. This increases privacy risk by encouraging broad retrospective analysis and persistence of metadata users may never have consented to extract or store.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill requests broad access to persistent storage and inbound/outbound media directories, plus proactive scanning for unprocessed files. That combination enables collection of files unrelated to a user's immediate request and materially increases the risk of over-collection, unauthorized retention, and accidental disclosure of local media.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 84% confidence
Finding: The installation instruction uses npx skills add without pinning a specific package version or commit, which can cause users to fetch and execute whatever version is current at install time. In a security-sensitive agent skill ecosystem, this creates a supply-chain risk because a compromised or malicious update could be pulled implicitly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README advertises automatic media copying, local persistence, autonomous auditing, and shell command execution, but does not warn users about privacy, storage, or host-system implications. In this skill context, that omission is more dangerous because the skill is explicitly designed to monitor conversations and persist potentially sensitive content, increasing the risk of unauthorized data collection, retention, and command misuse.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill's core behavior is to monitor conversations and persist memorable content, which creates a built-in retention risk for personal or sensitive data. Even without overt exfiltration, default collection and storage of user-generated content can capture information users did not intend to preserve long-term.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Reusing the last active group or conversation as default context can cause accidental archiving into the wrong group, especially when users say vague phrases like 'archive this.' That creates data integrity and privacy issues by retaining or misfiling content under an unintended conversation context.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 72% confidence
Finding: The workflow directs the agent to extract sender, group name, and summaries for storage, which constitutes persistence of conversational metadata and content beyond the live session. While central to the skill's function, it still presents a security/privacy risk because session data is intentionally retained and later reused.
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.
md
#### 3. Real-time Archiving When a memory is detected: 1. **Summarize**: Create a rich, 1-sentence summary. 2. **Identify**: Extract the sender and group name. 3. **Pre-flight**: Verify group context exists (step 2 above). 4. **Execute**: Call `remember-when add`.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Autonomous enrichment expands the skill from local archiving into external data retrieval without a strong necessity for the core archival function. That creates unnecessary attack surface and privacy risk because archived conversations or inferred locations may be used to query third-party services.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The changelog notes 'Enhanced English instructions for the agent,' which indicates a language-specific constraint in the skill's natural-language behavior. Because no user opt-in, alternative language support, or region-specific justification is provided here, this appears to conflict with the policy against forcing a specific language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The cross-collection examples use Catalan/Spanish phrases ("Viatge a París", "Nadal 2026") in user-facing guidance, which nudges a specific locale without stating that language choice is optional. The file does not explain a regional scope or offer the user a choice of language/locale for naming conventions.
Content: No source excerpt is available for this finding.