Security audit

Memory Lifecycle

Security checks across malware telemetry and agentic risk

Overview

This memory-management skill is not malicious, but it can silently save and later reuse conversation details across sessions, including implied preferences or project facts.

Install only if you want an agent to maintain durable memory for the workspace. Review the memoryFlush configuration before enabling it, and periodically inspect MEMORY.md and memory/ for sensitive or stale content. Avoid using it in workspaces where ordinary corrections, research notes, team details, or environment facts should not be retained across sessions without explicit approval.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The skill description and activation guidance are broad enough to trigger on ordinary conversational statements such as preferences, corrections, or environment facts, causing persistence without a clearly bounded user intent to store data. Because the skill writes durable memory before responding, it increases the risk of over-collection, accidental retention of sensitive operational details, and user-surprising persistence across sessions.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The implicit trigger list includes common conversational patterns like corrections, preferences, decisions, team facts, and environment info, but does not define boundaries or exclusions. In practice, this can cause routine chat content to be treated as durable memory, leading to privacy issues, stale or incorrect long-term state, and unintended propagation of operational facts into persistent storage.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill is explicitly designed to persist user preferences, corrections, decisions, team facts, and environment information across sessions, yet the top-level description does not present a privacy warning or consent boundary. That makes the capability more dangerous because users may not realize ordinary statements can be durably stored, especially when storage occurs implicitly and prior to acknowledgment.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The file explicitly configures a silent, automatic memory flush that appends to daily memory files, promotes entries into persistent MEMORY.md, creates backups, and writes lifecycle logs without any user-facing notice at the time of modification. Even if intended for legitimate memory management, silent persistence and mutation of workspace files can surprise users, create privacy concerns, and cause unintended retention of sensitive or stale information.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger conditions are broad enough to activate on ordinary phrases like deep research requests or when a user teaches a reusable procedure, which can cause the skill to run without explicit consent. Because this skill performs persistent filesystem writes and updates shared memory records, unintended invocation can create or alter durable state based on ambiguous user input.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs the agent to create directories, write multiple memory files, update MEMORY.md, and append to a lifecycle log, but it does not require notifying the user that these are persistent writes. This can lead to silent retention of sensitive project details, research contents, procedures, and decisions, increasing privacy risk and making accidental long-term data storage more likely.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: references/flush-prompt.md:16