Security audit

Total Recall

Security checks across malware telemetry and agentic risk

Overview

This skill has a coherent memory purpose, but it should be reviewed carefully because it persistently monitors conversation logs, sends them to LLM APIs, and includes broad workspace git operations that can affect unrelated files.

Install only if you want autonomous cross-session memory and are comfortable with conversation content being read, stored on disk, and sent to the configured LLM provider. Prefer a local LLM endpoint for private work, review the memory files regularly, start Dream Cycle in READ_ONLY_MODE=true, and avoid enabling the watcher/cron/compaction hooks until you understand the background execution. Be especially cautious with the Dream Cycle rollback and the .env loading behavior in shared or untrusted workspaces.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (35)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The compaction prompt explicitly instructs the agent to execute a shell command via bash during memory flushing. Even if the referenced script is intended for benign memory capture, embedding shell execution into a compaction pathway expands the agent's authority from summarization into command execution, creating a risky bridge from prompt text to local code execution.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The script unconditionally sources the workspace-wide .env file with `set -a`, importing every variable into the current shell. In Bash, `source` executes the file as code rather than merely parsing key/value pairs, so a malicious or compromised `.env` can run arbitrary commands whenever this helper is invoked. For a memory-maintenance skill, this is broader than necessary and increases the chance of secret exposure or code execution in the agent context.

Context-Inappropriate Capability

High

Confidence: 93% confidence
Finding: The `rollback` command performs `git reset --hard HEAD~1` against the entire workspace, which can discard unrelated uncommitted or newly committed changes outside this skill's memory files. That destructive repository-wide capability exceeds the stated purpose of safe memory file operations and could be abused or accidentally triggered to cause data loss.

Context-Inappropriate Capability

Medium

Confidence: 83% confidence
Finding: `write-staging` allows proposals targeting `AGENTS.md` and `TOOLS.md`, which extends this memory skill's influence into agent behavior and tool configuration rather than just memory artifacts. Even though it only writes staging proposals, this broadens the attack surface for prompt/instruction manipulation if downstream human review is weak or automated promotion is later added.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script sends recent user and assistant conversation content to an external API endpoint for summarization. In a memory skill, this creates a real confidentiality risk because sensitive session data leaves the local environment and is disclosed to a third-party provider, regardless of whether the feature is intentional.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The script claims to minimize credential exposure but uses eval on content extracted from $WORKSPACE/.env. If an attacker can modify that .env file, they can inject arbitrary shell syntax and achieve code execution during setup, which is much more severe than merely reading a credential.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README prominently advertises autonomous conversation observation and configurable external LLM providers, but it does not give a clear up-front warning that conversation content may be sent off-device to third-party APIs. In a memory skill that continuously monitors and compresses chats, this omission can cause users to expose sensitive data without informed consent.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The Dream Cycle section explains nightly archival, backups, and atomic updates to memory files, but does not present a strong up-front warning that the skill automatically modifies user-maintained memory artifacts. Automatic background mutation of user data is security-relevant because users may assume the skill is read-only or manually triggered unless clearly warned.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill prominently advertises autonomous observation of conversations while omitting an immediate privacy warning that transcripts are processed and may be sent to external LLM providers. Because conversation logs often contain secrets, personal data, or proprietary information, silent background collection and summarization materially increases confidentiality risk.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The setup flow asks users to configure API credentials and install the skill without clearly warning that transcript content will be transmitted off-host to third-party inference endpoints. This is dangerous because users may reasonably interpret setup as local memory management, not external data export of conversation history.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The cron job instructs an agent, in natural language, to run a shell command that launches an observer script against a workspace on a recurring 15-minute schedule. Because the trigger is broad and LLM-mediated rather than a tightly scoped structured task, the agent may interpret or expand the instruction unsafely, especially since it is pointed at a user workspace and told to return only script output, reducing visibility into what it actually did.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This configuration sets up unattended scheduled execution of a subprocess-like shell command every 15 minutes without any disclosure or warning in the file itself. In the context of a memory skill described as 'watching on its own,' this increases risk because it enables persistent background monitoring behavior that a user may not realize is occurring, potentially accessing or summarizing workspace data repeatedly.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger condition is broadly defined as context nearing compaction with a token threshold, without tighter constraints on when the workflow should activate or what classes of content may be persisted. In a memory skill, this increases the chance that sensitive or irrelevant session data is automatically processed and stored during normal operation, especially under frequent compaction conditions.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The prompt directs the agent to write key facts from the current session into a persistent memory file regardless of whether the observer succeeded, but provides no user-facing notice, consent flow, or retention boundary. In the context of a 'memory' skill that continuously watches conversations, this is especially dangerous because users may disclose sensitive information without realizing it will be retained beyond the session.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation explicitly states that conversation-derived data is persisted to plain Markdown files on disk and survives compaction, but it does not warn users about retention, local exposure, or the sensitivity of stored conversational content. In a memory skill whose purpose is to continuously observe and retain user interactions, this omission materially increases privacy risk because users may reasonably assume resets or compaction remove prior content when in fact it remains recoverable on disk.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The architecture says the observer reads recent session transcripts and extracts durable facts via an LLM, specifically recommending Gemini 2.5 Flash, but does not disclose that transcript content may be sent to an external model provider for processing. Because this skill is designed to continuously watch conversations and recover missed content, the context makes the issue more dangerous: users may unknowingly have broad portions of their chats processed by a third party without informed consent.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The prompt defaults `READ_ONLY_MODE` to `false`, which means the agent will perform archival and mutation of memory files unless an external caller explicitly overrides it. In an autonomous or loosely supervised environment, this creates a real risk of unintended destructive changes to user data without an explicit confirmation step or safe default.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The prompt explicitly instructs the agent to infer and record behavioral patterns from conversation logs (for example, work habits by time of day) without any mention of user consent, minimization, or opt-in controls. In a memory skill that continuously observes and summarizes user interactions, this creates a privacy risk by deriving sensitive profile information beyond what the user directly provided for task completion.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The script transmits the entire observations file to Anthropic for processing, and the skill description indicates this file is a memory store that may contain sensitive user conversation summaries. There is no explicit consent prompt, redaction step, or scope limitation before exfiltrating potentially private data to a third party, making this a real privacy and data-handling vulnerability.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The rollback path invokes a destructive hard reset without any user-facing confirmation, dry-run preview, or safety interlock in this file. This makes accidental invocation materially more dangerous because it can irreversibly remove workspace changes before an operator realizes the scope of the action.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script transmits recent transcript content to an external LLM service without any user-facing notice in the script or an interactive consent step. That makes the data flow security-relevant because users may reasonably assume memory processing is local and may expose confidential content unintentionally.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script sends the full contents of observations.md to a third-party LLM endpoint for consolidation. Because this file is a memory log that may contain sensitive conversation history, the external transmission creates a real confidentiality risk, especially since the script itself provides no runtime notice, consent gate, or data-minimization control before upload.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script writes recovered conversation content directly into a persistent observations file without any user-facing notice, consent check, or minimization. Because this includes prior user and assistant messages from session history, it creates covert retention of potentially sensitive natural-language data beyond the original session boundary.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script defaults to reading session history from a directory under the user's home folder, which may contain sensitive prior conversations, and does so automatically during recovery. Accessing and processing those files without transparent disclosure or explicit authorization increases privacy risk and expands the skill's effective data collection scope.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The snippet instructs the agent to automatically load multiple memory files on every new session before answering, including a search over stored memory, without any user-facing notice, consent, or data-minimization controls. This can expose prior-session personal or sensitive information to the model unnecessarily and broadens the context available to prompt injection or accidental disclosure in unrelated conversations.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: INSTALL-AGENT.md:31