Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent persistent memory skill, but its CLI has a real code-execution flaw and its long-term memory storage lacks clear privacy and retention controls.
Install only after reviewing the CLI and persistence risks. Avoid storing secrets, credentials, private prompts, or regulated personal data in this skill until the CLI argument injection is fixed and the memory store has clear opt-in, deletion, retention, redaction, and storage-location controls.
scripts/ichiro-mind.sh:111Arbitrary Python Code Execution Through CLI Argument Injection
package.json:16Python Runtime Incorrectly Declared as an npm Dependency
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
The skill clearly describes reading and writing persistent memory files such as SESSION-STATE.md and MEMORY.md, but it declares no explicit tool scope or permission boundaries. That creates an authorization gap where a host agent may grant broader file access than users expect, increasing the risk of unintended data reads, writes, or cross-workspace persistence.
The archive layer explicitly mentions long-term storage and cloud backup but does not warn about external storage exposure or the sensitivity of persisted memory. Moving agent memory into durable or remote storage expands the blast radius of any accidental capture, compromise, or misconfiguration.
This section promotes automatic memory capture and storage of user information without any privacy notice, consent flow, retention limit, or sensitivity guidance. In a memory skill, silent persistence of conversation-derived data can lead to collection of personal, confidential, or regulated information that users did not realize would be retained.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
The skill encourages persistent capture of user-provided information across sessions as a core feature, which creates surveillance and over-retention risk if not bounded by consent and data-minimization rules. Because the content is framed as normal operation, an integrating agent may store far more conversational data than is necessary for the task.
These use-case descriptions encourage broad automatic collection and long-term retention of user relationships, preferences, history, and accumulated knowledge without corresponding safeguards. In context, this makes the skill more dangerous because its purpose is persistent memory, so any weak privacy practice becomes systemic rather than incidental.
The skill explicitly promotes persistent storage of user preferences and long-term memories across multiple storage layers, but it does not provide any clear warning, consent mechanism, or retention limits. This is dangerous because agents may collect and retain personal or sensitive conversation data by default, increasing the risk of privacy violations, over-collection, and unintended disclosure if the memory store is accessed or misused.
The documented auto-capture behavior states that conversation text can be automatically ingested into vector memory, yet there is no accompanying warning that user content may be stored persistently. In the context of a memory skill designed for durable recall, this raises the likelihood that sensitive prompts, personal details, or confidential project information will be silently embedded and retained.
The HOT layer writes session state directly to disk in SESSION-STATE.md with no consent, disclosure, retention control, or filtering of sensitive values. In a memory skill whose purpose is to capture conversational state, this creates a real privacy risk because arbitrary user content may be persisted locally in plain text where other local users, backups, or tooling can access it.
This file write persists session state to disk in a plain-text markdown file, creating durable storage of potentially sensitive conversational context. Because the code provides no warning, encryption, permission hardening, or opt-out, the persistence behavior is a legitimate privacy/security weakness rather than a false positive.
return state
def _save(self):
"""Save state to file (WAL protocol)"""
md_content = self._to_md()
self.filepath.write_text(md_content)
The SQLite schema for neurons establishes persistent storage for memory content, meaning user-provided data is retained locally across sessions. In isolation database creation is normal, but in this skill's context it stores free-form memory content without consent, minimization, or protective controls, making it a real privacy-relevant issue.
# Neurons (memories)
cursor.execute("""
CREATE TABLE IF NOT EXISTS neurons (
id INTEGER PRIMARY KEY,
content TEXT NOT NULL,
type TEXT,
The remember() path is explicitly designed to persist arbitrary caller-provided content across multiple storage layers and daily logs based only on importance thresholds, with no sensitivity classification, secret detection, or policy gating. In the context of an agent memory system, this is especially risky because users may unknowingly provide credentials, health data, internal prompts, or other sensitive material that will be retained and propagated.
The auto_capture() logic extracts preferences and decisions from free-form text and stores them automatically, which can silently convert casual conversation into retained profile data. This increases privacy and profiling risk because sensitive inferences can be captured without user awareness, and the skill context makes this more dangerous since persistent memory is the product's core behavior.
The skill exposes both storage and retrieval primitives for arbitrary user content, making it straightforward for sensitive information placed into memory to be retrieved in later interactions. In a persistent memory system, that semantic design materially increases the risk of cross-session disclosure, especially if multiple tasks, users, or trust boundaries share the same memory backend.
The remember tool persists arbitrary user-provided content but gives no warning, consent flow, or data-handling boundary before storage. In a memory skill intended for agent use, this creates a real privacy and retention risk because secrets, personal data, or transient prompts may be stored unintentionally and later surfaced through recall.
The recall function returns full remembered content directly in plain text, with no masking, authorization check, or sensitivity filtering. If secrets, credentials, personal data, or internal instructions were ever stored, a simple query could exfiltrate them verbatim, making this more dangerous in a general-purpose persistent memory skill than in a narrowly scoped application.
The learning path stores decision, outcome, lesson, and optional context as persistent experience data without notifying the caller that these fields may be retained. Because these fields can easily contain sensitive operational history or personal information, silent retention increases the chance of privacy violations and later unintended disclosure.
The script initializes persistent storage under ~/.ichiro-mind and creates a SESSION-STATE.md file, which can retain potentially sensitive memory, context, or user data across sessions. In a memory-management skill, persistence is expected, but without explicit permissioning, retention limits, or access controls, stored data may be exposed to other local processes, backups, or unintended future use.
init() {
echo -e "${YELLOW}Initializing Ichiro-Mind...${NC}"
# Create directories
mkdir -p ~/.ichiro-mind/{backups,logs}
# Initialize databases
The top-level natural-language description presents the skill identity using a fixed Chinese label alongside the English name, with no indication that language or locale is configurable. For a general-purpose skill, hard-coded language presentation can violate language-choice policy when no opt-in or preference mechanism is provided.
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"python": ">=3.9"
},
"optionalDependencies": {
"openai": "^1.0.0",
"lancedb": "^0.5.0"
}
}
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
},
"optionalDependencies": {
"openai": "^1.0.0",
"lancedb": "^0.5.0"
}
}
Line L003 includes a Chinese-language title string as part of the user-facing script header, but the file does not indicate that Chinese is optional, selectable, or required for a region-specific purpose. This can violate language/locale policy expectations when a skill imposes a specific language without user opt-in.