Security audit

Memory Strategy

Security checks across malware telemetry and agentic risk

Overview

This memory skill has a coherent purpose, but it asks agents to persist conversation content, handle API-key-related memory, and optionally send text to an external Kimi API without enough safeguards.

Install only if you are comfortable with local persistent memory files and can constrain how they are used. Do not store API keys, tokens, passwords, or other secrets in .memory files; keep .memory out of source control; avoid Kimi API scoring for confidential text unless you explicitly accept third-party transmission; and disable or manually approve Silent Agent auto-writes until the publisher documents consent, retention, redaction, and the missing helper scripts.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill sends user-provided memory content to an external Kimi API for semantic scoring, which exceeds a local memory-management function and creates an unnecessary data exfiltration path. Because the content being scored may include sensitive conversation details, this can disclose private information to a third party without clear necessity or consent.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The retrieval design explicitly includes loading API keys from long-term memory, which is highly sensitive secret material and not appropriate for a conversational memory skill. Persisting and retrieving credentials in normal memory files greatly increases the chance of accidental exposure, prompt leakage, or unintended reuse by the agent.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger conditions are broad enough to activate during ordinary conversation, including generic phrases about remembering or recalling information and automatic archival at session end. This raises the risk of unintended invocation, causing data to be stored, reclassified, or retrieved when the user did not mean to engage a persistence feature.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill description advertises silent automatic organization and archiving but does not clearly warn users that conversation content may be written to persistent storage automatically. This undermines informed consent and can lead to unexpected retention of sensitive or private user information.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The Kimi API scoring flow lacks a clear warning that user text may be transmitted to an external service. In a memory-management context, the text may contain personal data, work product, or secrets, so undisclosed third-party transmission materially increases privacy and compliance risk.

Ssd 3

High

Confidence: 99% confidence
Finding: The skill instructs persistence and retrieval of sensitive data, including contacts, API keys, and conversation-derived content, in ordinary memory files without minimization or access safeguards. This creates a high-risk repository of secrets and personal data that may later be exposed through retrieval, indexing, logs, backups, or prompt injection into future sessions.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The Silent Agent design reviews the entire conversation and automatically archives 'important' content, which can sweep up sensitive disclosures far beyond what the user expected to retain. Because this occurs at session end or timeout, the user may not have a meaningful chance to review, redact, or refuse storage before private information is persisted.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.