Security audit

awareness-memory

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for persistent AI memory, but its one-command installer runs unpinned remote code that can persistently alter local agent and IDE behavior.

Review this before installing. Run the setup only if you are comfortable with it changing MCP and IDE or agent configuration for future sessions. Prefer a pinned, reviewed package version, inspect the installer source or release notes, avoid elevated privileges, and check the resulting config and workflow-rule diffs before continuing to use it.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:24
Finding: Unpinned Third-Party Packages Are Installed or Executed
Content: View full analysis
Remediation: View remediation
awareness-setup pip install awareness-memory-cloud== npm install @awareness-sdk/memory-cloud@ --save-exact ``` 2. Publish and reference the package source repository and immutable release commit so users can inspect the implementation before execution. 3. Provide registry integrity hashes, signed release artifacts, or package provenance attestations, and document how users should verify them. 4. Use lockfiles for SDK integrations and enable lockfile integrity validation in automated environments. 5. Recommend downloading and inspecting the setup package before running it rather than directly executing the latest registry release. 6. Run setup with the least privileges necessary. Do not use elevated administrator or root privileges. 7. Require user confirmation before changing MCP configuration, `CLAUDE.md`, `.cursor/rules`, or other persistent agent instructions. Display a complete diff of proposed changes before applying them. 8. Consider disabling package lifecycle scripts during installation where compatible, then explicitly run only reviewed setup steps. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The manifest-level description itself references an unpinned npx install command, which can cause consumers or automated tooling to propagate and trust a non-reproducible setup path. Because this skill promotes persistent memory integration into agent environments, a malicious package update could affect multiple sessions and clients after installation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The skill instructs users to execute npx @awareness.market/setup without pinning a specific package version, so every install resolves to whatever package is current in the registry at execution time. Because this setup tool auto-detects IDEs, writes MCP configuration, and injects workflow rules, a compromised or malicious upstream release could directly alter local developer tooling and agent behavior.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This installation command fetches and runs code from npm without version pinning, creating a supply-chain risk window where later package updates can change behavior invisibly. In this skill, the risk is amplified because the tool is advertised as automatically modifying MCP and IDE configuration, giving executed code meaningful control over local agent workflows.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: Referencing the setup command again without a version pin reinforces an unsafe execution pattern and normalizes running mutable remote package code. Since the command is tied to automatic config writing and rule injection, exploitation could lead to persistence, altered prompts, or unauthorized behavior in downstream AI tooling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill does disclose later that the CLI writes MCP config and injects workflow rules, but it does not present this prominently as a user warning before or alongside the install instruction. That omission reduces informed consent around persistent local configuration changes, which is especially sensitive here because the tool modifies agent startup behavior and memory usage across sessions.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.