Security audit

MemWeaver

Security checks for vulnerabilities and agentic risk

Overview

MemWeaver is not plainly malicious, but it needs review because it profiles private memory data and includes overly broad local file read/write paths without strong consent or safety boundaries.

Only install this if you deliberately want an agent to inspect your memory logs and infer personal traits. Review which .codebuddy files will be read, avoid running it on memories that may contain secrets or untrusted pasted instructions, and do not use custom --profile or --output paths unless you fully trust the command being run. Treat generated profiles and backups as sensitive personal data and delete them when no longer needed.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/collect_memory.py:103
Finding: Untrusted Memory Content Is Passed to the Agent Without Prompt-Injection Isolation
Content: View full analysis
The script reads long-term memory and recent logs, outputs JSON to stdout. The Agent parses `content.long_term` and `content.daily_logs` fields from the JSON. ### Step 2: LLM Deep Analysis The Agent analyzes collected memory in 3 sub-tasks: ``` ### Technical Analysis The collector reads complete long-term memory and daily log files and serializes their contents into the JSON consumed by the Agent. Memory files are data files, but they may contain instruction-like text supplied by users, imported content, compromised integrations, or other untrusted sources. The Skill instructions direct the Agent to parse and analyze these fields but do not establish a trust bounda ...[truncated 2132 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/collect_memory.py:39
Finding: Arbitrary Local File Read Through the Profile Argument
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/save_profile.py:27
Finding: Arbitrary File Creation and Overwrite Through the Output Argument
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented purpose emphasizes memory mining and interactive confirmation, but the actual described mechanics mainly persist content and perform filesystem writes/backups. Such description-behavior mismatch can bypass informed consent and security review because materially different data processing occurs than what the skill promises.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented purpose emphasizes memory mining and interactive confirmation, but the actual described mechanics mainly persist content and perform filesystem writes/backups. Such description-behavior mismatch can bypass informed consent and security review because materially different data processing occurs than what the skill promises.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill is expressly designed to mine memory files for hidden traits, contradictions, energy triggers, and skills, then aggregate those inferences into a structured user profile. This is sensitive-data aggregation and psychological profiling: even if no secrets are exfiltrated, concentrating scattered memory into a durable profile substantially raises harm from disclosure, overreach, or manipulative downstream use.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The questionnaire is built from real memory content and explicitly records all answers internally as profile evidence, creating a feedback loop that deepens and confirms sensitive inferences. This increases danger because the system is not just reading existing data but eliciting additional personal disclosures and binding them to a lasting profile.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README markets hidden-trait discovery and contradiction mining without an upfront warning that the skill performs sensitive personal profiling on memory files. This can undermine informed consent by encouraging users to expose intimate behavioral patterns, inferred personality traits, and historical logs without clear disclosure of privacy risks, potential misclassification, or the need for explicit review before profile generation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The installation/loading guidance uses a generic invocation pattern that could cause the skill to be activated when a user or agent makes a loosely related request. Because this skill performs sensitive memory mining and personal profiling, accidental activation exposes private historical data and may initiate profiling without sufficiently deliberate user consent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The example prompts are common everyday-language requests like 'Analyze my profile' and 'What kind of person am I based on my memory?' that may be matched unintentionally by an agent's routing logic. In the context of a profiling skill that inspects memory contents and infers hidden traits, ambiguous triggers increase the risk of unauthorized or surprise execution on sensitive personal data.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill reads and writes workspace files (MEMORY.md, memory/*.md, and generated profile outputs) but declares no explicit tool scope or permissions. That creates a transparency and policy gap: an agent may access sensitive files and persist derived data without the user being clearly warned or the runtime being constrained.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs analysis of long-term memory and daily logs to infer hidden traits, contradictions, emotional triggers, and unlabeled skills, but does not present a prominent privacy warning or consent gate beforehand. Because these sources can contain highly personal or behavioral data, profiling without clear advance disclosure materially increases privacy and misuse risk.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The staged workflow first derives behavioral and psychological inferences from memory, then uses batched, trust-building questions to validate and deepen those inferences. In this context, the interaction pattern is more dangerous because it systematically nudges the user into confirming or expanding a sensitive profile, which can normalize intrusive analysis and increase the volume and reliability of collected personal data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly defines inference over a user's language and interaction patterns, including hidden behavioral patterns and preferences, without any indication of user knowledge, consent, or opt-in. This creates a privacy risk because the agent is directed to derive sensitive or unexpected profile attributes from normal conversation, potentially exceeding the user's reasonable expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill tells the agent to save a generated profile and automatically back up old profiles, but this persistence and duplication of sensitive profiling data is not clearly warned about in user-facing terms. Silent retention increases the chance of unwanted long-term storage, secondary access, or exposure of sensitive personality inferences.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.