Security audit

Agent Memory Cleanup

Security checks across malware telemetry and agentic risk

Overview

This skill reads and cleans agent memory files, and its sensitive file access is disclosed, scoped to that purpose, and guarded by approval before edits.

Install only if you want an agent to inspect long-term memory files for cleanup. Review proposed diffs before applying, keep backups until satisfied, and avoid using --output or --write-proposed paths that could expose memory reports or overwrite unrelated files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares no required permissions, yet its content instructs the agent to run Python scripts, access and modify memory files, and create backups, which implies shell, file-read, and file-write capabilities. This mismatch weakens permission transparency and policy enforcement, increasing the chance that a host agent executes sensitive operations without an explicit capability grant or adequate user awareness.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The script accepts arbitrary filesystem paths for both --write-proposed and --output and writes attacker-influenced content to those locations without restricting them to discovered memory files or a safe workspace. In a skill meant to audit and clean memory files, this broad write capability expands the blast radius from memory maintenance to generic file overwrite, which could clobber unrelated project files if the caller passes a sensitive path.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The --write-proposed option writes the first generated proposal to any caller-supplied path, even in non-apply modes, and the destination is not validated against the memory-cleanup scope. Because proposed content is derived from potentially sensitive memory material, this can overwrite arbitrary files or redirect sanitized-but-still-sensitive content into unintended locations.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The activation guidance is broad enough to match common requests like 'review' or 'clean' memory-like files, which increases the chance the skill will run in situations the user did not specifically intend. In a skill that can inspect and later modify long-term memory files, overbroad triggering can lead to unnecessary access to sensitive personal context and unintended cleanup recommendations.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The README endorses automatic auditing when 'memory pressure' is detected and says the user need not explicitly invoke the skill, which is overly permissive for a tool that reads sensitive long-term memory files. Even if edits still require approval, automatic inspection can expose private data unnecessarily and normalize operation without sufficiently specific user consent.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: When --write-proposed is used, the tool writes directly to the requested path with no interactive confirmation, overwrite warning, or safety check. In practice this makes accidental or induced destructive writes easier, especially because the option is available in a tool whose primary purpose sounds read-mostly until explicitly approved cleanup is requested.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The file contains a plaintext staging password stored in long-term memory, which creates an immediate secret-exposure risk if the file is read, indexed, synced, logged, or committed. In the context of a memory-cleanup skill, this is especially dangerous because these files are intended for persistent recall, so retaining credentials there increases both exposure duration and likelihood of reuse by the agent or humans.

Ssd 3

High

Confidence: 99% confidence
Finding: This memory entry explicitly preserves a user's password for future recall, which is an unsafe use of persistent agent memory and directly violates secret-handling best practices. Because the skill operates on agent memory files, the context makes the issue more severe: the file is specifically a place the agent may revisit, copy, or modify, compounding the chance of credential disclosure or misuse.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: test-fixtures/secret-memory.md:4

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: test-fixtures/short-polluted-memory.md:6