Security audit
Security checks for vulnerabilities and agentic risk
This is a real local memory skill, but it persistently stores conversation-derived content and tells agents to reuse recalled memory in privileged prompt context without enough safeguards.
Review this skill before installing. It is not evidence of malware, but it can retain sensitive conversation and tool-history data across sessions and may reintroduce that data into future agent behavior. Only enable it for workspaces where persistent memory is appropriate, avoid storing secrets or regulated data, verify the database location and filesystem permissions, and do not rely on the advertised SQLCipher encryption unless the package version you install actually implements and enforces it.
tcc/core/reconciler.py:84Persistent untrusted memory is promoted into privileged system-prompt context
tcc/core/store.py:61Sensitive persistent memory is stored in plaintext despite an encryption claim
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
def main():
with tempfile.TemporaryDirectory() as tmp_dir:
db_path = os.path.join(tmp_dir, "test_raven.db")
env = {**os.environ, "RAVEN_DB_PATH": db_path}
print("Starting Raven MCP server...")
proc = subprocess.Popen(
The README explicitly promotes persistent storage of user preferences, session history, decisions, and significant events across sessions, but it does not pair that behavior with a clear privacy notice, retention policy, consent model, or guidance on sensitive-data minimization. In an agent skill context, this can lead operators to deploy durable collection of personal or sensitive prompts without users understanding that their content will be retained locally for long periods.
The setup instructions tell users to automatically call raven_start_session with the user's first message and to record significant events, effectively encouraging automatic ingestion of user input into persistent memory without any user-facing disclosure or consent step. This is more dangerous in an agent plugin because these instructions are meant to be copied directly into operational configs, making silent collection of prompts and potentially sensitive data likely.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Automatic — no code required
When multiple agents write to the same database concurrently, Raven detects when all open branches are done and fires an auto-merge milestone:
main chain ──●──●──●──────────────────────────────●── (merge milestone)
Without declared permissions the skill's intent is opaque and cannot be validated.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
env = {**os.environ, "RAVEN_DB_PATH": db_path}
print("Starting Raven MCP server...")
proc = subprocess.Popen(
[sys.executable, "-m", "tcc.integration.mcp_server"],
stdin=subprocess.PIPE,
stdout=subprocess.PIPE,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
time.sleep(0.2)
# Restart server with same DB
proc = subprocess.Popen(
[sys.executable, "-m", "tcc.integration.mcp_server"],
stdin=subprocess.PIPE,
stdout=subprocess.PIPE,
The description emphasizes convenience and persistence but does not clearly warn users that conversation history, decisions, tool calls, and session activity are stored across sessions by default. This weak disclosure can lead users to share sensitive information without understanding that it will be retained and later resurfaced through search or session initialization.
The skill explicitly instructs the agent to call memory-loading and event-recording tools at the start of every conversation and throughout the session by default. This creates always-on cross-session persistence of user content and agent activity without any built-in consent gate, minimization, or context sensitivity, which can expose sensitive data and cause inappropriate reuse of prior context.
The system prompt guidance directs the agent to persist and reload the user's first message and subsequent session events across conversations by default. This is dangerous because it operationalizes cross-session data retention and retrieval at the prompt level, increasing the chance of storing personal, confidential, or security-sensitive content and reintroducing it in unrelated future contexts.
The delete method removes records from the nodes and node_parents tables and commits the change immediately. There is no confirmation prompt, logging/print statement, or explanatory comment/docstring warning that this operation is destructive, which matches the missing-warning criterion for code files.
The start-session flow accepts a user message/topic as search_query and uses it for semantic retrieval over persistent history, while the tool descriptions encourage injecting that content into long-term memory workflows. Without clear disclosure and minimization, sensitive user text may enter storage, embedding, or retrieval pipelines and become queryable across sessions.
The MCP tools explicitly persist user- and agent-supplied events across sessions, but the interface provides no user-facing notice, consent flow, retention policy, or controls over what gets stored. In an agent-memory skill, this is particularly sensitive because conversations, tool results, and inferred preferences may be recorded automatically and later surfaced, creating privacy and compliance risk if users are unaware of persistence.
The optional dependency sqlite-vec>=0.1.0 is not pinned to a known-safe version, and the package family has known heap-buffer-overflow advisories. Because this skill is an agent memory component that may process untrusted content and store embeddings locally, a vulnerable native SQLite extension could increase risk if the optional vector path is enabled.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
torch>=2.1.0 sets only a lower bound, so package resolution may install any later version, including one with unresolved security issues or breaking changes. Given PyTorch's history of unsafe deserialization and model-loading risks, lack of exact pinning weakens supply-chain control.
torch>=2.1.0
transformers>=4.45.0
langgraph>=0.2.0
langgraph-checkpoint-sqlite
torch has multiple published advisories, and because the manifest does not pin an exact version, there is no way to verify whether installations will avoid affected releases. In ML systems, vulnerable PyTorch versions can be especially dangerous due to model loading, checkpoint handling, and native code execution paths.
transformers>=4.45.0 is not fully pinned, allowing unreviewed newer versions to be installed. For a package that often processes remote models and complex inputs, this creates avoidable supply-chain and compatibility risk.
torch>=2.1.0
transformers>=4.45.0
langgraph>=0.2.0
langgraph-checkpoint-sqlite
langchain-core>=0.3.0
transformers has known advisories, but the unpinned requirement prevents determining whether deployed environments are safe. In an agent skill that may fetch or process external model artifacts, this uncertainty materially increases risk compared with a pinned, vetted release.
langgraph>=0.2.0 allows indefinite version drift, which can introduce vulnerable checkpointing or orchestration behavior without code changes in the skill. In an agent memory/orchestration component, dependency predictability is especially important because it handles execution flow and state.
torch>=2.1.0
transformers>=4.45.0
langgraph>=0.2.0
langgraph-checkpoint-sqlite
langchain-core>=0.3.0
accelerate
langgraph has known advisories and the open-ended version specifier makes it impossible to verify whether affected versions are excluded. Since LangGraph is central to orchestration and checkpoint/state behavior, vulnerable releases could affect agent execution integrity or state handling.
The dependency langgraph-checkpoint-sqlite is completely unpinned, so installs may pull different versions over time, including newly introduced vulnerable or breaking releases. In a persistence/memory skill that stores agent state, this increases supply-chain risk and makes builds non-reproducible.
torch>=2.1.0
transformers>=4.45.0
langgraph>=0.2.0
langgraph-checkpoint-sqlite
langchain-core>=0.3.0
accelerate
sqlite-vec
langgraph-checkpoint-sqlite has multiple advisories, including SQL injection-related issues, and the dependency is unpinned, so the manifest provides no assurance that safe versions will be installed. This skill's stated purpose is persistent agent memory, making the checkpoint/storage layer directly relevant and increasing the practical danger of vulnerable releases.
langchain-core>=0.3.0 is only minimally constrained, so installations may pick up future versions with security regressions or breaking behavior. Because LangChain components often handle prompts, files, URLs, and tool interactions, uncontrolled updates can meaningfully expand attack surface.
transformers>=4.45.0
langgraph>=0.2.0
langgraph-checkpoint-sqlite
langchain-core>=0.3.0
accelerate
sqlite-vec
sentence-transformers
langchain-core has several advisories, and because only a lower bound is given, deployments may resolve to an affected version. In agent systems that interact with prompts, tools, files, and URLs, vulnerable framework components can create significant secondary attack surface.
Detected: suspicious.prompt_injection_instructions