Security audit

memory-system

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed memory protocol, but it asks agents to permanently retain and back up exact conversation transcripts without clear privacy controls.

Install only if you intentionally want full transcript memory. Treat the memory and backup locations as sensitive data stores: avoid sharing secrets, use private/encrypted storage, restrict access to backups and shared mirrors, and define your own deletion and redaction rules before enabling this protocol.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

High

Confidence: 97% confidence
Finding: The protocol explicitly requires persistent logging of every exchange and an exact verbatim transcript, which creates a real privacy and data-retention risk. Even if intended for continuity, this can capture secrets, personal data, credentials, and sensitive prompts without minimization, consent, retention limits, or access controls, making later leakage or misuse much more likely.

Ssd 3

Medium

Confidence: 91% confidence
Finding: The README explicitly recommends preserving exact verbatim conversation transcripts and replaying them at startup, which creates a durable retention mechanism for all user-provided content, including sensitive data that may have been shared incidentally. In the context of long-running AI agents, this increases the chance of privacy violations, over-collection, and unintended re-exposure of secrets across sessions or agents.

Ssd 3

High

Confidence: 96% confidence
Finding: The quick-start instructs agents to append every conversation turn after every reply and then mirror those logs to an external backup, which operationalizes broad collection and propagation of user inputs without any visible consent, filtering, or sensitivity controls. This is more dangerous than local retention alone because it multiplies copies of potentially sensitive data and expands the exposure surface to backup systems and any downstream readers.

Ssd 3

Medium

Confidence: 88% confidence
Finding: Calling verbatim transcripts a 'personal-history record' that must never be summarized, omitted, or rewritten encourages indiscriminate preservation of conversational content regardless of sensitivity or relevance. In an agent-memory skill, that framing makes the behavior more dangerous because it discourages privacy-preserving editing, redaction, and minimization even when users disclose secrets or regulated data.

Ssd 3

Medium

Confidence: 95% confidence
Finding: Persisting exact user/agent transcripts in natural language creates a durable store of sensitive context that can be unintentionally exposed, searched, or replayed in future sessions. The danger is increased because the skill frames verbatim logging as mandatory and exact, discouraging data minimization.

Ssd 3

Medium

Confidence: 92% confidence
Finding: The startup checklist instructs the agent to reload prior logs before continuing, which increases the chance that previously stored user data will be resurfaced or reused outside the original context. This can propagate stale, sensitive, or no-longer-authorized information into new conversations and widen the blast radius of any prior logging.

Static analysis

No suspicious patterns detected.