Self-Evolving Memory

• Outcome: Pass
• Latest audit: Aug 8, 2026 · 8:24 AM UTC
• Version: 0.1.1

Overview

This is a local-first AI memory management skill whose file access, persistence, secret-handling helpers, and optional retrieval/scheduling are disclosed and mostly bounded to the stated memory-system purpose.

Install this only if you want an agent to keep durable local memory about you, its work, and its relationship/context with you. Keep SECRET.md handle-only, do not allow plaintext credentials in memory files, and review or disable scheduled consolidation if you do not want automatic profiling or long-term retention.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill describes operational behaviors that imply broad capabilities—reading and writing local files, optional semantic retrieval, scheduler integration, and possibly shell/network-backed host features—without any declared permission model or capability scoping. In an agent environment, this can let a seemingly advisory skill gain effective access to sensitive files and execution surfaces without transparent user consent or runtime restriction.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared purpose presents the skill as a memory-management mentor, but the behavior extends into secret discovery, credential pattern scanning, redaction/migration, permission enforcement, and atomic rewrites of local files. That mismatch is dangerous because users and policy systems may authorize the skill for memory operations while it also processes sensitive secret material and performs destructive filesystem changes outside the stated scope.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases in this range are broad enough to match ordinary user conversation, which can cause the memory skill to activate unintentionally. In this skill's context, unintended activation is more dangerous because it can lead an agent to persist, consolidate, or reason over conversational content as long-term memory without explicit user intent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The file instructs the agent to persist promotion decisions and content summaries to `self-reference/promotion-log.md` without any user-facing notice, consent flow, retention limit, or data-minimization rule. In a memory skill, this is especially risky because the logged summaries may contain user preferences, behavioral patterns, or other sensitive context that accumulates over time in local storage.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This section instructs the agent to modify indexes, promote memories into persistent files, compress older episodic records, and delete or replace detail, but it does not require an explicit user-facing notice or consent checkpoint before altering retained data. Even with strong transactional safeguards and rollback, the operation can still permanently reshape or remove stored context in ways the user may not expect, creating integrity and retention risks rather than classic code-execution risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This section directs the system to persist relationship inferences, user-profile traits, and reflective diary content derived from interactions, but it lacks a clear privacy warning, consent requirement, or minimization boundary for storing sensitive personal and relational information. In the context of a memory skill designed for long-term persistence, this is especially dangerous because it normalizes ongoing accumulation of behavioral and intimate profile data that may exceed user expectations and increase privacy harm if exposed or misused.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The guide explicitly instructs the agent to persist user information into local memory files but provides no privacy boundaries, consent checks, data minimization rules, retention limits, or warnings against storing sensitive data. In a memory-management skill, this omission is security-relevant because it normalizes durable storage of personal information and can lead to over-collection, unintended retention, or later disclosure through retrieval, indexing, backup, or operator access.

VirusTotal

51/51 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.