Memory Setup 1.0.0

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:01 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent memory-setup guide, but it recommends indexing private memory and past sessions with remote embedding providers without enough privacy warning or scoping guidance.

Review what will be indexed before installing. Prefer the local provider or memory-only sources for sensitive work, and avoid putting secrets, credentials, regulated data, or confidential transcripts into memory or session indexing unless you have approved the provider and retention policy.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:16
• Finding: Remote Embedding Provider May Process Sensitive Memory and Session Data## Vulnerability Details **File Location**: `SKILL.md`, lines 16–27; related provider and source descriptions at lines 65–82 **Vulnerability Type**: Privacy-sensitive configuration with unsafe remote-provider defaults **Risk Level**: Medium ### Vulnerable Configuration ```json { "memorySearch": { "enabled": true, "provider": "voyage", "sources": ["memory", "sessions"], "indexMode": "hot", "minScore": 0.3, "maxResults": 20 } } ``` The related documentation describes the selected provider and sources as follows: ```markdown ### Provider Options - `voyage` — Voyage AI embeddings (recommended) - `openai` — OpenAI embeddings - `local` — Local embeddings (no API needed) ### Source Options - `memory` — MEMORY.md + memory/*.md files - `sessions` — Past conversation transcripts - `both` — Full context (recommended) ``` ### Technical Analysis The recommended quick-start configuration enables a remote embedding provider while indexing both persistent memory and previous session transcripts. These data sources may contain personal information, confidential project context, credentials pasted into conversations, internal identifiers, or other sensitive material. Processing text with a remote embedding provider ordinarily requires sending the selected content to that provider. The documentation does not warn users about this data flow, require explicit consent before enabling session indexing, recommend reviewing provider retention and privacy policies, or instruct users to redact sensitive data. Although a local provider is mentioned, it is not the recommended privacy-preserving default. This is categorized as `T09: Insecure Skill Coding Practices` because the unsafe configuration guidance can expose sensitive information through insufficiently protected data handling. There is no evidence that the Skill intentionally steals data or that it contains executable malicious code. ...[truncated 1473 chars]
• Remediation: ## Remediation Suggestions 1. Make `local` the default embedding provider, particularly when indexing session transcripts or persistent memory. 2. Require explicit user opt-in before sending either `memory` or `sessions` content to a remote provider. 3. Add a prominent warning that remote providers receive content required to create embeddings. 4. Recommend excluding session transcripts by default and enabling only the minimum sources required. 5. Instruct users to remove secrets, credentials, regulated data, and unnecessary personal information before indexing. 6. Document how to review provider retention, training-use, regional-processing, deletion, and access-control policies. 7. Provide a privacy-oriented configuration such as: ```json { "memorySearch": { "enabled": true, "provider": "local", "sources": ["memory"], "indexMode": "hot", "minScore": 0.3, "maxResults": 20 } } ``` 8. If a remote provider is necessary, recommend narrowly scoped credentials, source-level filtering, encryption in transit, retention controls, and periodic deletion of obsolete indexed material.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs users to enable persistent indexing of MEMORY.md, daily logs, project notes, preferences, and past session transcripts, but it does not warn that this may collect sensitive personal or confidential data. That omission is dangerous because users may unknowingly ingest private information into a searchable memory system, increasing exposure, retention, and accidental disclosure risk.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The provider configuration recommends third-party embedding services such as Voyage AI and OpenAI without warning that indexed memory content may be transmitted to external providers for embedding generation. In the context of a memory feature that may contain user preferences, project history, and prior conversations, this creates a meaningful privacy and confidentiality risk if users assume processing is local.

Static analysis

No suspicious patterns detected.