Security audit

Raven Memory

Security checks for vulnerabilities and agentic risk

Overview

Raven Memory is a coherent local memory skill, but it stores and automatically reuses cross-session agent history with weak privacy boundaries and an unsupported encryption claim.

Install only if you intentionally want persistent local agent memory. Keep separate Raven databases for separate projects or users, do not store secrets or regulated data, treat recalled memory as untrusted context rather than system instructions, and do not assume the database is encrypted unless you independently verify SQLCipher support.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (23)

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The status tool returns the full local database path to any MCP client that can call it, exposing unnecessary host-environment information. While this does not directly grant file access, it leaks filesystem layout and the location of sensitive persistent memory, which can aid further targeting or exfiltration attempts by an untrusted client or prompt-driven agent.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The README instructs agents to record 'significant events' automatically, but gives no concrete exclusions for secrets, personal data, credentials, tokens, or regulated content. In a persistent cross-session memory system, this ambiguity can lead to over-collection and long-term retention of sensitive data that users did not expect to be stored.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The setup text tells the agent to automatically send the user's first message to raven_start_session as a search query and to inject returned history before responding, without any explicit notice or consent flow. First messages often contain sensitive context, and using them for persistent retrieval can expose private data to storage, indexing, or later sessions unexpectedly.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The skill instructs the agent to invoke persistent memory loading at the start of every conversation with the user's first message as the search query, without any scoping, consent, or sensitivity checks. In a memory skill, this creates a broad default data-access path that can surface unrelated or sensitive prior-session information into the active context, increasing the chance of privacy leakage and overcollection.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill advertises persistent storage of agent activity and session history but does not present a clear warning to users that their interactions may be retained across sessions. For a memory/persistence skill, the lack of explicit disclosure undermines informed consent and can lead to unexpected retention of sensitive content in a local database.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The session-start and search tools are designed to retrieve prior session data and even instruct the caller to inject returned history into the system prompt, but they do not communicate privacy or prompt-injection risks from stored content. In a memory skill, recalled historical text may contain sensitive data or adversarial content from prior sessions, making silent retrieval and prompt injection materially risky.

Ssd 3

Medium

Confidence: 95% confidence
Finding: Using the user's first message as a natural-language search query to load prior memory into context creates a direct pathway for cross-session data resurfacing based on ambiguous prompts. This is especially risky because retrieved memory is injected before responding, so prior private or sensitive information can influence outputs or be disclosed without the user explicitly requesting historical recall.

Ssd 3

Medium

Confidence: 89% confidence
Finding: The description states that Raven records everything the agent does, including decisions, tool calls, parallel work, and session history, which promotes indiscriminate retention rather than minimization. In a persistent memory skill, this broad capture increases the likelihood that secrets, personal data, or sensitive operational details will be stored and later retrievable.

Unpinned Dependencies

Low

Category: Supply Chain
Content: torch>=2.1.0 transformers>=4.45.0 langgraph>=0.2.0 langgraph-checkpoint-sqlite langchain-core>=0.3.0 accelerate sqlite-vec
Confidence: 92% confidence
Finding: The dependency langgraph-checkpoint-sqlite is completely unpinned, allowing installs to float to any newly published version. In a security-sensitive memory/checkpointing skill, that increases supply-chain risk and can silently introduce vulnerable or malicious releases into deployments.

Unpinned Dependencies

Low

Category: Supply Chain
Content: langgraph>=0.2.0 langgraph-checkpoint-sqlite langchain-core>=0.3.0 accelerate sqlite-vec sentence-transformers
Confidence: 90% confidence
Finding: The accelerate package is unpinned, so builds are not reproducible and may pull in unexpected code changes over time. While not an exploit by itself, this weakens supply-chain control and can expose the environment to newly introduced vulnerabilities.

Unpinned Dependencies

Low

Category: Supply Chain
Content: langgraph-checkpoint-sqlite langchain-core>=0.3.0 accelerate sqlite-vec sentence-transformers datasets
Confidence: 93% confidence
Finding: sqlite-vec is unpinned despite being a native/extension-style dependency with a disclosed memory-safety issue in the findings. Floating versions in this case increase the risk of pulling a compromised or unstable build into a component that processes stored memory data.

Unpinned Dependencies

Low

Category: Supply Chain
Content: langchain-core>=0.3.0 accelerate sqlite-vec sentence-transformers datasets
Confidence: 88% confidence
Finding: sentence-transformers is unpinned, which creates non-reproducible environments and supply-chain exposure through uncontrolled upgrades. In an AI skill, model and library behavior can change significantly across releases, potentially affecting security assumptions and data handling.

Unpinned Dependencies

Low

Category: Supply Chain
Content: sqlite-vec sentence-transformers datasets
Confidence: 88% confidence
Finding: The datasets package is unpinned, so installations may resolve to different versions with different transitive dependencies and security posture. This increases supply-chain uncertainty even if no specific exploit is visible in this file alone.

Unpinned Dependencies

Low

Category: Supply Chain
Content: torch>=2.1.0 transformers>=4.45.0 langgraph>=0.2.0 langgraph-checkpoint-sqlite
Confidence: 95% confidence
Finding: torch is only lower-bounded (>=2.1.0) rather than pinned, which allows deployment to pick any future version and leaves known vulnerable ranges possible depending on resolver behavior. Given torch's history of deserialization-related issues and its central role in executing ML workloads, loose versioning materially raises risk.

Unpinned Dependencies

Low

Category: Supply Chain
Content: torch>=2.1.0 transformers>=4.45.0 langgraph>=0.2.0 langgraph-checkpoint-sqlite langchain-core>=0.3.0
Confidence: 95% confidence
Finding: transformers is specified as >=4.45.0, which is not sufficient to exclude future or current vulnerable releases and permits non-reproducible dependency resolution. Because this library often handles model/config/tokenizer loading and parsing of external artifacts, weak pinning can directly amplify attack surface.

Unpinned Dependencies

Low

Category: Supply Chain
Content: torch>=2.1.0 transformers>=4.45.0 langgraph>=0.2.0 langgraph-checkpoint-sqlite langchain-core>=0.3.0 accelerate
Confidence: 94% confidence
Finding: langgraph is only minimally constrained, so deployments may install versions with known unsafe checkpoint-loading behavior or future regressions. In a skill built around persistent causal memory and workflow state, the framework is security-critical, making unpinned upgrades especially dangerous.

Unpinned Dependencies

Low

Category: Supply Chain
Content: transformers>=4.45.0 langgraph>=0.2.0 langgraph-checkpoint-sqlite langchain-core>=0.3.0 accelerate sqlite-vec sentence-transformers
Confidence: 94% confidence
Finding: langchain-core is loosely versioned, increasing the chance of deploying versions affected by file-read, template-injection, or SSRF-style issues noted in advisories. Since agent frameworks frequently process prompts, tools, and external content, version drift can create serious security exposure.

Known Vulnerable Dependency: torch — 10 advisory(ies): CVE-2025-2953 (PyTorch susceptible to local Denial of Service); CVE-2022-45907 (PyTorch vulnerable to arbitrary code execution); CVE-2025-32434 (PyTorch: `torch.load` with `weights_only=True` leads to remote code execution) +7 more

Critical

Category: Supply Chain
Confidence: 97% confidence
Finding: The project depends on torch while the analysis reports multiple severe advisories, including arbitrary code execution and unsafe loading behaviors. In an AI agent skill, model artifacts and serialized objects are commonly loaded, so a vulnerable torch version can turn normal workflow operations into code-execution or denial-of-service paths.

Known Vulnerable Dependency: transformers — 10 advisory(ies): CVE-2023-2800 (transformers has Insecure Temporary File); CVE-2025-3933 (Transformers is vulnerable to ReDoS attack through its DonutProcessor class); CVE-2024-3568 (Transformers Deserialization of Untrusted Data vulnerability) +7 more

Critical

Category: Supply Chain
Confidence: 95% confidence
Finding: transformers is flagged with multiple serious advisories including insecure temporary file handling, ReDoS, and deserialization of untrusted data. This is especially risky in a memory-oriented AI skill where models, processors, tokenizers, and external artifacts may be loaded or processed from user-influenced sources.

Known Vulnerable Dependency: langgraph — 2 advisory(ies): CVE-2026-28277 (LangGraph checkpoint loading has unsafe msgpack deserialization); CVE-2026-28277 (LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver th)

Critical

Category: Supply Chain
Confidence: 90% confidence
Finding: langgraph is reported as affected by unsafe checkpoint loading via msgpack deserialization. Because this skill's core purpose is persistent agent memory and causally linked state, vulnerable checkpoint loading is directly relevant and could enable code execution or malicious state manipulation if attacker-controlled data reaches the checkpoint path.

Known Vulnerable Dependency: langgraph-checkpoint-sqlite — 3 advisory(ies): CVE-2025-8709 (LangGraph's SQLite store implementation has a SQL Injection Vulnerability); CVE-2025-64104 (LangGraph SQLite Checkpoint Filter Key SQL Injection POC for SqliteStore); CVE-2025-67644 (LangGraph's SQLite is vulnerable to SQL injection via metadata filter key in SQL)

High

Category: Supply Chain
Confidence: 96% confidence
Finding: langgraph-checkpoint-sqlite is flagged with multiple SQL injection advisories in metadata/filter key handling. This is highly relevant because the skill is explicitly a persistent memory system likely to store and query state in SQLite, so attacker-influenced metadata or filters could lead to unauthorized data access, corruption, or persistence compromise.

Known Vulnerable Dependency: langchain-core — 10 advisory(ies): CVE-2026-26013 (LangChain affected by SSRF via image_url token counting in ChatOpenAI.get_num_to); CVE-2024-10940 (langchain-core allows unauthorized users to read arbitrary files from the host f); CVE-2025-65106 (LangChain Vulnerable to Template Injection via Attribute Access in Prompt Templa) +7 more

Critical

Category: Supply Chain
Confidence: 95% confidence
Finding: langchain-core is associated with severe advisories including arbitrary file read, template injection, and SSRF-like behavior. In an agent skill that remembers actions, tool calls, and session history, these capabilities are often exposed to user-influenced prompts and tool inputs, making exploitation more plausible and potentially leading to host compromise or sensitive data exfiltration.

Known Vulnerable Dependency: sqlite-vec — 1 advisory(ies): CVE-2024-46488 (Heap-based Buffer Overflow in sqlite-vec)

High

Category: Supply Chain
Confidence: 91% confidence
Finding: sqlite-vec is flagged for a heap-based buffer overflow, which can cause crashes and may enable memory corruption exploitation depending on usage context. Since this skill likely uses vectorized storage for persistent memory retrieval, malformed data or crafted queries could affect availability or potentially worse in the database extension layer.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: skill.md:65