PARA Second Brain

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:51 AM UTC
• Version: 2.0.1

Overview

This skill is a coherent local second-brain setup, but it encourages broad long-term indexing of notes and conversation history without enough privacy controls.

Review before installing. Use this only in workspaces where long-term memory is appropriate, and do not enable session transcript indexing or whole-folder symlinks until you have excluded secrets, credentials, private personal data, regulated data, and confidential material. Prefer selectively linking vetted folders, storing concise summaries instead of full conversations, and keeping a clear process to review and delete memory files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:103
• Finding: Overbroad Session Transcript Indexing May Expose Sensitive Conversation Data## Vulnerability Details **File Location**: `SKILL.md`, lines 103-114 **Vulnerability Type**: Privacy-sensitive data retention and indexing without adequate safeguards **Risk Level**: Medium ### Vulnerable Code ```markdown ### 3. Enable Session Transcript Indexing Make your past conversations searchable too. Add this to your Clawdbot config: ```json "memorySearch": { "sources": ["memory", "sessions"], "query": { "minScore": 0.3, "maxResults": 20 } } ``` ``` ### Technical Analysis The recommended configuration indexes complete session transcripts as a semantic-search source. The instructions do not establish consent requirements, retention periods, access restrictions, content exclusions, or redaction controls for credentials and other sensitive information. Conversation transcripts can contain API keys, authentication tokens, personal information, proprietary source code, internal infrastructure details, and confidential business data. Once indexed, such content may remain searchable beyond the context and lifetime of the original conversation. The configuration does not itself transmit data externally or grant operating-system privileges. The risk arises from unnecessarily broad local persistence and retrieval of sensitive information. ### Attack Path 1. A user or connected system supplies sensitive information during a conversation. 2. Session transcript indexing is enabled according to the Skill instructions. 3. The sensitive information becomes part of the searchable session index. 4. A later user, agent session, or process with access to the same workspace or memory-search facility submits a related semantic query. 5. Search results disclose the retained information outside its original conversational context. Successful exploitation requires access to the applicable agent workspace or memory-search interface. No remote unauthenticated exploitation path was identified. ### Impact Assessment The issue may compromise the confidentia ...[truncated 383 chars]
• Remediation: ## Remediation Suggestions 1. Make session transcript indexing disabled by default and require explicit, informed opt-in. 2. Explain which transcript data is stored, where it is stored, who can query it, and how long it remains available. 3. Apply automatic redaction for API keys, passwords, authentication tokens, private keys, financial information, and regulated personal data before indexing. 4. Support configurable retention periods and automatic deletion of expired transcripts and embeddings. 5. Restrict memory-search access to the user or session that created the underlying data unless sharing is explicitly authorized. 6. Provide allowlists and exclusion rules so users can select which conversations or message classes may be indexed. 7. Encrypt stored transcripts and indexes where supported, with restrictive filesystem permissions. 8. Provide a documented mechanism to inspect, delete, and rebuild the index after sensitive information is removed.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:175
• Finding: Indiscriminate Memory Flush Instructions May Persist Sensitive or Untrusted Content## Vulnerability Details **File Location**: `SKILL.md`, lines 175-209 **Vulnerability Type**: Unsafe persistent storage of broadly defined conversational content **Risk Level**: Medium ### Vulnerable Code ```markdown ### Writing Rules - If it has future value, write it down NOW - Don't rely on "mental notes" — they don't survive restarts - Text > Brain 📝 ### PARA Structure - **Projects** (`notes/projects/`) — Active work with end dates - **Areas** (`notes/areas/`) — Ongoing responsibilities (health, finances, relationships) - **Resources** (`notes/resources/`) — Reference material, how-tos, research - **Archive** (`notes/archive/`) — Completed or inactive items ### Memory Flush Protocol Monitor your context usage with `session_status`. Before compaction wipes your memory, flush important context to files: | Context % | Action | |-----------|--------| | < 50% | Normal operation | | 50-70% | Write key points after substantial exchanges | | 70-85% | Active flushing — write everything important NOW | | > 85% | Emergency flush — full summary before next response | | After compaction | Note what context may have been lost | **The rule:** Act on thresholds, not vibes. If it's important, write it down NOW. ``` The instructions are repeated later in the same file: ```markdown ### Threshold-Based Actions | Context % | What to Do | |-----------|------------| | **< 50%** | Normal operation. Write decisions as they happen. | | **50-70%** | Increased vigilance. Write key points after each substantial exchange. | | **70-85%** | Active flushing. Write everything important to daily notes NOW. | | **> 85%** | Emergency flush. Stop and write full context summary before responding. | | **After compaction** | Immediately note what context may have been lost. Check continuity. | ``` ### Technical Analysis The Skill directs the agent to persist broadly defined “important” information based on context-window utilization. Importance is subjective, and the instructions do not ...[truncated 2245 chars]
• Remediation: ## Remediation Suggestions 1. Replace “write everything important” with a data-minimizing policy that stores only information necessary for an explicitly identified future task. 2. Require user confirmation before persisting credentials, personal information, confidential business data, health information, financial information, or complete conversation summaries. 3. Explicitly prohibit storing passwords, API keys, access tokens, private keys, recovery codes, session cookies, and authentication headers. 4. Add secret scanning and sensitive-data redaction before writing memory files. 5. Record the source and trust level of persisted information, and prevent quoted or attacker-supplied instructions from being treated as authoritative agent rules. 6. Separate private memory by user, tenant, and workspace, with restrictive filesystem permissions. 7. Define retention periods and provide user-accessible review, correction, and deletion mechanisms. 8. During emergency context flushing, store concise task state, decisions, and open actions rather than a full conversation summary. 9. Require explicit approval before adding personal relationships, key dates, or other profile data to long-term memory.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The code's actual behavior is limited to filesystem scaffolding and template file creation. While the PARA directory structure portion of the description is accurate, the main differentiating claims—making everything searchable, using symlinks, indexing session transcripts, and providing a memory flush protocol—are not implemented in this code chunk. This is a material description-to-behavior mismatch because the declared purpose promises capabilities beyond simple setup.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The symlink step broadens the searchable corpus from limited memory files to the entire notes tree without warning about exposure scope. Users may unintentionally make private, sensitive, or irrelevant notes available to semantic retrieval, increasing the chance of accidental disclosure or misuse by downstream tools.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill encourages indexing session transcripts for later retrieval but does not warn that transcripts may contain sensitive data, secrets, or regulated personal information. This can lead to over-collection and long-term searchability of content users did not expect to be retained in a semantic index.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly promotes retaining and indexing conversation transcripts, which can include confidential discussions, personal data, and operational details. Without consent, minimization, or retention controls, this creates unnecessary persistent storage and a larger attack/disclosure surface.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The MEMORY.md template instructs the agent to store personal details such as relationships, birthdays, anniversaries, and preferences for long-term recall. Persistently recording this kind of personal profile data without boundaries or necessity increases privacy risk and may violate data-minimization expectations.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The AGENTS.md guidance repeatedly tells the agent to write down important information immediately and preserve continuity across sessions, encouraging broad retention of user context. In practice, this can cause indiscriminate storage of sensitive information, internal deliberations, or transient data that should not be persisted.

Static analysis

No suspicious patterns detected.