Agent Memory Persistence

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 7:41 AM UTC
• Version: 0.1.0

Overview

This is a local SQLite memory library for agents, with no evidence of hidden execution, network exfiltration, or unrelated privileged behavior.

Before installing, treat this as a local persistent memory database: avoid storing secrets or highly sensitive conversation content unless you control the database path, access permissions, retention policy, and deletion workflow. Pin dependencies if you need reproducible or stricter supply-chain controls.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

The code largely matches the declared persistence/storage aspects: it uses SQLite, stores structured metadata and embeddings, supports create/read/update/delete, filtering by user/session/time/type, expiration lifecycle management, and stats. However, the description explicitly claims semantic retrieval, which would imply embedding-based similarity search or vector querying. The supplied code only stores embeddings as JSON and never performs similarity computation, nearest-neighbor lookup, or embedding-aware retrieval. Thus the description overstates a core capability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README explicitly promotes long-term storage of user- and session-linked memories, including free-text content, metadata, and embeddings, but provides no privacy, consent, retention, or deletion guidance. In an agent-memory component, this omission can lead integrators to persist sensitive personal or conversational data indefinitely, increasing risk of privacy violations, over-collection, and noncompliant data handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The natural-language documentation is entirely in Chinese, with no indication that language choice is optional or that the skill is intended only for a Chinese-speaking or region-specific audience. This can violate the language/locale policy when a specific language is imposed without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json

"typecheck": "tsc -p tsconfig.json --noEmit"
  },
  "dependencies": {
    "better-sqlite3": "^11.10.0"
  },
  "devDependencies": {
    "@types/better-sqlite3": "^7.6.12",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 16)May include surrounding context.

json

"better-sqlite3": "^11.10.0"
  },
  "devDependencies": {
    "@types/better-sqlite3": "^7.6.12",
    "@types/node": "^24.0.0",
    "tsx": "^4.20.0",
    "typescript": "^5.8.2"

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 17)May include surrounding context.

json

},
  "devDependencies": {
    "@types/better-sqlite3": "^7.6.12",
    "@types/node": "^24.0.0",
    "tsx": "^4.20.0",
    "typescript": "^5.8.2"
  }

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 18)May include surrounding context.

json

"devDependencies": {
    "@types/better-sqlite3": "^7.6.12",
    "@types/node": "^24.0.0",
    "tsx": "^4.20.0",
    "typescript": "^5.8.2"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 19)May include surrounding context.

json

"@types/better-sqlite3": "^7.6.12",
    "@types/node": "^24.0.0",
    "tsx": "^4.20.0",
    "typescript": "^5.8.2"
  }
}

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code performs a destructive delete of stored memory records, but there is no confirmation prompt, logging, comment, or docstring warning that data will be removed. For a code-file warning audit, destructive operations should include some visible disclosure unless clearly documented elsewhere as expected behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.