memocap

• Outcome: Review
• Latest audit: Aug 14, 2026 · 1:37 PM UTC
• Version: 2.3.3

Overview

This local memory skill is broadly disclosed, but it auto-loads, persistently stores and resurfaces conversation data, exports or visualizes it, and can silently apply stored workflows.

Review before installing. Use it only if you want an always-on local memory layer for OpenCode, understand that conversation content may be stored and resurfaced later, and are comfortable managing the local data, backups, exports, and visual HTML files yourself. Avoid storing secrets or regulated personal data, disable auto-open/profile capsule behavior where possible, and inspect/delete the local memory directory if you uninstall.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (54)

Tainted flow: 'BACKUP_FILE' from os.environ.get (line 71, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

try:
        record = {"id": mem_id, "content": content, "metadata": metadata, "backup_at": _now().isoformat()}
        line = json.dumps(record, ensure_ascii=False)
        with open(BACKUP_FILE, "a", encoding="utf-8") as f:
            f.write(line + "\n")
    except Exception as e:
        print(f"  ⚠️ 备份写入失败: {e}", file=sys.stderr)

• Confidence: 89% confidence
• Finding: with open(BACKUP_FILE, "a", encoding="utf-8") as f:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises shell, file read/write, and environment-dependent behavior but does not declare any permissions or user-facing constraints. In a skill that auto-loads every session and persists memory, undeclared capabilities reduce transparency and can enable silent data access, modification, export, or command execution beyond what users reasonably expect.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The stated description focuses on memory retrieval, but the documented behavior includes importing external files, exporting stored memories, persistent backups, deletion/recovery, HTML generation, and launching external programs. That mismatch is dangerous because users may consent to a benign-sounding recall feature while the skill actually has broad data handling and execution capabilities.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill presents itself as a memory system, but import/export features allow reading arbitrary local files into persistent storage and writing memory contents to arbitrary output paths. In an agent setting, that broad file I/O capability can be repurposed for local data collection and exfiltration well beyond normal memory-capsule behavior.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The code stores type=skill memories and later trigger-matches them during recall, effectively creating a persistent skill-routing layer that can influence future agent behavior. In a security-sensitive agent environment, poisoned or overly broad trigger memories could steer actions or surface adversarial instructions under innocuous queries.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: Generating a profile page also persists a new time-capsule memory by default, which is a non-obvious state-changing side effect beyond the script's primary retrieval/reporting role. This can silently mutate the memory store, create feedback loops or data pollution, and capture potentially sensitive profile content without explicit user consent.

Intent-Code Divergence

Low

• Confidence: 86% confidence
• Finding: The documentation frames the tool mainly as material extraction and page generation, while the actual behavior includes persistent archival as an automatic side effect. That mismatch increases the chance that operators run a seemingly read-oriented tool and unknowingly write sensitive derived data back into long-term storage.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: The script automatically opens the generated HTML, which contains sensitive memory content, in the user's default browser without explicit confirmation. In a memory-visualization context this increases the chance of unintended disclosure through browser history, sync, extensions, shoulder surfing, or opening on a shared desktop session.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The skill’s stated purpose is memory retrieval/capsules, but it also instructs the agent to generate desktop HTML artifacts and open them automatically. That expands capability from data recall into local file creation and UI launching, which can surprise users, expose sensitive memory contents on-screen, and create an unnecessary pathway for unsafe local actions.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Automatically opening generated files on the user’s machine is a local side effect that is not clearly necessary for a memory skill. If the generated HTML contains sensitive recalled data, this can disclose private information to anyone viewing the screen, and normalizing auto-open behavior increases the risk of future abuse for more dangerous payloads.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README instructs users to store and retrieve persistent memory data but does not clearly disclose that potentially sensitive user content will be retained locally in a database. In a memory-oriented skill, users may input personal, confidential, or regulated information, so the absence of explicit privacy and retention warnings increases the risk of unintentional sensitive data collection and long-term exposure on disk.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The trigger list includes broad conversational phrases like recall-related words and implies activation in many ordinary dialogue contexts. For a skill that stores and retrieves persistent memory automatically, such broad triggering can cause unintended activation, over-collection of user content, and surprise execution of memory workflows without meaningful consent.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The skill says it auto-activates every conversation, proactively associates memories, and runs scenario-based scans, including timed checks. In context, this makes the memory system much more dangerous because it is designed to operate continuously and ambiguously, increasing the chance of silent retention, retrieval, and processing of sensitive user data.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The command documentation exposes storage, export, deletion/forgetting, recovery, backup inspection, and visualization features but does not warn users that sensitive conversational data may be persisted and later exported or deleted. Lack of notice undermines informed consent and increases the risk of accidental exposure or loss of personal information.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The initialization step instructs the agent to run a local Python script that creates ChromaDB collections and writes persistent data under a user directory, but it does not clearly warn the user that filesystem state will be modified. In an agent-skill context, undisclosed persistence is security-relevant because it changes local state, may consume disk, and may create sensitive memory stores without explicit user consent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The module explicitly instructs the agent to proactively surface previously stored memories ('主动说出') without waiting for a user request, but provides no consent, notice, or privacy guardrails. This can cause unexpected disclosure of past sensitive information in the current conversation context, especially if others can view the chat or if the recalled material is emotionally sensitive.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly says that after a long conversation it can extract key memories and automatically store them to Chroma, but it provides no notice, opt-in, or consent checkpoint. Because the content is user conversation data and may contain sensitive personal information, silent persistence creates a privacy and data-governance risk, especially in a memory-oriented skill designed to retain context over time.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The scheduled workflow runs unattended commands that modify memory state in the background, including automatic forgetting/archive actions, without any user-facing warning or approval flow. Even if data is not deleted, silent background modification of stored memories can affect integrity, visibility, and user expectations about how their data is managed.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The module explicitly encourages storing detailed personal memories, emotions, and keywords for later retrieval, but provides no privacy warning, consent language, retention guidance, or handling restrictions for sensitive data. In a memory-capture skill, this increases the chance that users will input highly sensitive personal information that could later be exposed through listing, unsealing, logs, backups, or other downstream storage paths.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The module documents bulk import/export of memory data, including complete JSON backups and migration workflows, but provides no warning about handling sensitive personal data, access control, or secure storage of exported files. In a memory system that stores dates, emotions, keywords, and narrative content, this omission can lead users to expose highly sensitive personal information during backup, sharing, or device migration.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The example trigger phrase is a broad everyday term (e.g. '漫画') that can appear in ordinary conversation, making unintended activation of a stored skill likely. Because this system is designed to auto-recall and apply hidden workflow behavior, loose triggers can silently alter outputs without explicit user consent in contexts where the user did not mean to invoke the skill.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation rule says ordinary dialogue should always be checked and that recall hits on trigger keywords naturally cause the skill to be used, but it does not define clear boundaries, priority, or consent requirements. This ambiguity is dangerous because it enables over-triggering, hidden behavior changes, and unpredictable execution of stored workflows based on incidental wording.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The document explicitly endorses hidden automatic execution of recalled skills and states that the user need not know a skill was loaded. That creates a deceptive control-flow change: stored instructions can modify the assistant's behavior, outputs, and follow-up actions without transparency, which is especially risky in a memory system that persists and evolves over time.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The setup text explicitly enables automatic memory retrieval and storage on every conversation, but it does not provide a clear warning about what data may be retained, how long it is kept, where it is stored, or how users can review and delete it. In a memory-capture skill, this omission is security- and privacy-relevant because users may disclose sensitive personal or organizational information without understanding that it will be persistently stored and resurfaced later.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The archive trigger uses broad, subjective conditions such as 'near the end of conversation' and examples like short closing phrases. In a memory-capturing skill, ambiguous end-of-session detection can cause unintended persistence of user data without a clear, user-initiated archival action.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.