Memory (MemoryLake)

The skill is explicitly positioned as a catch-all for any MemoryLake-related request, which creates overly broad activation scope and increases the chance it will be selected for sensitive or higher-risk operations without tighter routing controls. In context, this is more dangerous because the skill can discover remote API capabilities dynamically and perform direct authenticated actions, so accidental over-invocation can expose or modify data beyond the user’s likely intent.

The instruction that the agent may call any MemoryLake API endpoint directly is effectively an unrestricted capability grant. Because the skill also instructs the agent to fetch the live OpenAPI spec and use stored credentials, it can expand its reachable action surface at runtime to undocumented, newly added, or dangerous endpoints without prior review, increasing the risk of unauthorized data access or modification.

The skill documents destructive operations such as project, memory, and document deletion but does not require an explicit warning or confirmation workflow before executing them. In this context, that omission is risky because the skill is a general-purpose direct API caller using bearer-token auth, so a mistaken invocation could lead to irreversible data loss across a user’s MemoryLake resources.

The CLI path prints the fully merged configuration object to stdout, which includes sensitive fields such as apiKey and projectId. In agent and automation environments, stdout is commonly captured in logs, tool traces, shell history wrappers, or parent-process outputs, making accidental credential disclosure likely even without an external attacker directly invoking the script.

The skill instructs the agent to recursively upload directories and automatically extract archives, but it does not require an explicit user-facing warning or confirmation that many files may be transmitted to a remote service. This creates a real risk of over-sharing sensitive local data, especially when users may think they are uploading a single item while the skill expands and uploads all contained files.

The CLI prints the fully merged configuration object to stdout, which includes sensitive fields such as apiKey and projectId. In agent and automation contexts, stdout is commonly captured in logs, transcripts, shell history, or downstream tool output, so this can unintentionally disclose credentials to other users, processes, or monitoring systems.

The skill can recursively upload directories and extract archives into many files, but it does not require an explicit confirmation step or present a clear pre-upload summary of what will be transmitted. In an agent context, that increases the risk of unintended bulk exfiltration of local data, especially when users provide broad paths or archives whose contents they have not reviewed.

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

The skill explicitly migrates data associated with a caller-supplied user identifier but then submits all imported content under the hardcoded API user_id "default". This creates an identity-mapping flaw that can merge multiple users' memories into a shared bucket, causing privacy violations, data contamination, and loss of provenance.

The skill instructs exfiltrating session histories and memory files to an external service without an explicit warning that sensitive local data will leave the system. Users or operators may trigger the skill expecting local migration logic, not realizing that private conversations, memory files, tokens, or regulated data could be transmitted off-host.

This script reads local memory files and session transcripts, then uploads their contents to a remote MemoryLake API. Because those files can contain sensitive personal data, prompts, secrets, or internal context, performing the export without an explicit privacy warning, confirmation step, or scoping preview creates a real data-exposure risk if the operator misunderstands what will be sent.

The core behavior of the skill is to collect memories and conversation history from local storage and send them to MemoryLake. Even if migration is the intended feature, this is still sensitive-data transfer functionality with substantial confidentiality risk because it operates on complete histories rather than narrowly scoped records.

The manual fallback directs reading a session index and opening matched session JSONL files to extract user and assistant messages for upload. This materially increases exposure because it operationalizes bulk access to private conversation archives and makes exfiltration possible even when the safer scripted path fails.

The skill instructs reading MEMORY.md and all files under the workspace memory directory, then sending their full contents to the remote API. Memory files often contain distilled personal preferences, secrets, project notes, or other high-value data, so full-file upload creates significant confidentiality and compliance risk.

The submission instructions specify packaging extracted conversation text and file contents into authenticated API requests, preserving message content and batching uploads. This is a concrete exfiltration workflow for sensitive local data to an external service, and the detailed automation increases the likelihood and scale of unintended disclosure if invoked improperly.