Security audit
Security checks for vulnerabilities and agentic risk
This is a simple memory/reminder helper with no evidence of hidden execution, data exfiltration, credential access, or system persistence.
Before installing, treat this as a lightweight or demo-style memory helper rather than a reliable persistent reminder system. Avoid storing secrets or highly sensitive personal information unless the publisher adds clear retention, review, and deletion controls.
The invocation description is very broad and overlaps with common productivity and memory-related requests, which can cause the skill to activate for a wide range of everyday prompts. That increases the chance of unintended handling of sensitive personal information and user confusion about when data is being stored or acted on.
The skill advertises storage of personal notes, reminders, and contextual triggers like time and location, but it does not warn users that personal information may be retained and processed. This creates a privacy risk because users may disclose sensitive data without understanding retention, context use, or the implications of location- and event-based reminders.
The skill is designed to accept and store free-form user memories and reminders, which are likely to include sensitive personal data such as schedules, relationships, and locations. There is no consent flow, privacy notice, data minimization, access control, or retention policy, so if this storage were made persistent or integrated into a larger agent system, it could create privacy and data-handling risk.
The user-facing fallback text says the skill can 'remember something, set a reminder, link memories, search for saved information, or list your reminders,' implying persistent management of previously saved data. However, handle_request creates a new MemoryManager instance at L079 for each call, which clears memories, reminders, and connections every time, so prior saves cannot be searched or listed across requests.
No suspicious patterns detected.
