T08 · Insecure Dependencies
Warning
- Location
SKILL.md:110- Finding
Unpinned and Unverified Third-Party Plugin Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
SeekDB Memory
Security checks for vulnerabilities and agentic risk
Overview
This memory skill clearly describes cloud-based automatic recall and storage, but it enables broad automatic persistence of conversation-derived facts without enough user control or documented safeguards.
Review this carefully before installing. Only enable it if you trust the m0 plugin and the configured cloud endpoint, and avoid using it for secrets, credentials, health, financial, legal, or confidential business information unless your deployment has separate controls for consent, redaction, retention, access review, and deletion.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:22- Finding
Automatic Cloud Storage of Conversation-Derived Data Without Documented Safeguards
- Content
View full analysis
` in the prompt. 2. **After each conversation**: The m0 plugin automatically extracts key facts from the conversation and stores them. No manual `memory_store` needed for routine facts. ``` Lines 123-130 provide a configurable destination and enable automatic capture: ```json { "plugins": { "entries": { "m0": { "enabled": true, "config": { "apiKey": "ak_your_key_here", "baseUrl": "https://your-endpoint", "autoCapture": true, "autoRecall": true, "recallLimit": 10 ``` ### Technical Analysis The documented configuration enables automatic extraction and remote persistence of facts derived from conversations. Conversation content can contain personal information, confidential project details, authentication material, internal system information, or regulated data. The remote destination is controlled through the `baseUrl` setting, but the skill does not document endpoint allowlisting, certificate pinning, destination validation, sensitivity classification, secret redaction, explicit per-user consent, access controls, retention limits, audit logging, or verified deletion. A maliciously modified or incorrectly configured endpoint could therefore receive future auto-captured data. The issue is aggravated by automatic operation aft ...[truncated 2103 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill advertises automatic cloud storage and automatic recall of conversation facts without clearly warning that user content may be transmitted to and retained by a remote service. In a memory skill, this context makes the issue more dangerous because ordinary chats can include secrets, credentials, health data, or other sensitive information that users may not expect to be persisted across sessions.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation explicitly states that key facts are extracted via LLM and stored in the cloud after each conversation. This default collection pipeline can capture personal, proprietary, or security-sensitive details from normal dialogue, making accidental overcollection and long-term retention highly likely.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The Automatic Behavior section documents post-conversation extraction and storage of key facts without an explicit warning that sensitive information may be captured incidentally. Because this occurs by default and after each conversation, the skill can collect far more data than a user reasonably expects, increasing privacy and compliance risk.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill directs unconditional memory injection before each conversation and fact storage after each conversation, which creates both privacy and prompt-safety risks. Persisted content may include sensitive or maliciously planted text that is later reintroduced into the agent context, causing cross-session data exposure or memory-based prompt injection.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The description says to use the skill whenever the agent needs 'long-term memory, persistent context, or cross-session recall,' which is broad and lacks explicit constraints or exclusion cases. This can overlap with common conversational situations and does not clearly define when the skill should not be invoked.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Automatic cloud capture and recall creates a mechanism for plain-language sensitive data to be collected and later resurfaced in unrelated future sessions. In this skill's context, persistent memory is the core feature, so unintended retention and cross-session reuse are realistic and can expose personal or confidential information to the model or downstream tools.
- Content