Security audit

Every conversation leaves a trace. Every decision echoes.

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed local memory tool, but it asks to automatically persist broad conversation details and inferred personal traits across sessions without enough user control.

Install only if you intentionally want autonomous persistent memory. Before use, clear the bundled memory files, avoid AGENTS.md or HEARTBEAT automation by default, do not store secrets, health, financial, or confidential business details, and avoid auto_session until the inline Python interpolation issue is fixed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (30)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill expands from an on-demand memory aid into an always-on system that loads and captures data in every session without a user trigger. This broadens data collection beyond the stated use case and creates persistent cross-session processing of user content without clear consent boundaries.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The instructions tell operators to modify AGENTS.md and HEARTBEAT.md so the behavior becomes agent-wide and persistent outside the skill's own storage. That creates durable behavioral changes that may affect all future sessions and can bypass normal user expectations about when the skill should run.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The code automatically infers and records broad personal preference data about the user ('boss 喜欢/不喜欢', preference changes) from free-form conversation rather than limiting storage to explicit memory commands. In a memory skill, this expands collection beyond clear user intent and can create hidden profiling of sensitive behavioral traits across sessions.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The script performs emotion and sentiment profiling ('boss 情绪') and stores inferred emotional state from ordinary conversation. Emotional-state inference is especially privacy-sensitive because it derives data the user may not have intended to persist, increasing the risk of covert profiling and misuse.

Vague Triggers

High

Confidence: 97% confidence
Finding: The trigger conditions are effectively universal: every session start, every session end, and daily heartbeat. Such broad activation means the skill can process nearly all conversations by default, greatly increasing the chance of unnecessary retention of sensitive or irrelevant information.

Vague Triggers

High

Confidence: 96% confidence
Finding: Criteria like 'any decision,' 'any preference,' 'any emotion,' and 'any evaluation' are too vague and expansive to support safe minimization. In practice, they encourage overcollection of personal and contextual data from ordinary conversation, including sensitive behavioral and emotional information.

Missing User Warnings

High

Confidence: 94% confidence
Finding: The skill prominently advertises fully automatic memory but does not give a clear warning that entire conversations may be analyzed and persisted across sessions. Users may therefore disclose sensitive information without understanding that it will be retained and reused later.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The integration instructions automatically load memory files and index conversation-derived data without explaining how sensitive data is handled, protected, or excluded. This omission increases the likelihood that private information will be surfaced in future contexts or stored insecurely.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The configuration enables `auto_trigger` globally without defining any conditions, scope limits, or guardrails for when memory capture should occur. In a memory skill that persists cross-session information, this can cause over-collection of sensitive user data, unintended activation on irrelevant conversations, and privacy or policy violations because the trigger boundary is undefined.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The document explicitly instructs automatic capture of full-conversation content plus inferred preferences, decisions, contradictions, and emotional state without any opt-in, notice, minimization, or retention disclosure. This creates a privacy and security vulnerability because highly sensitive user data is persistently collected and inferred beyond what the user explicitly requested, increasing the chance of overcollection, misuse, and downstream disclosure.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The protocol describes an automatic pipeline that analyzes the entire conversation and writes results into permanent/current memory layers at session end, with no confirmation step or warning about persistent writes. In the context of an agent skill, this is dangerous because it silently converts transient chat into durable stored data, including potentially sensitive or regulated information.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The guide instructs automatic analysis and memory capture of conversation content without documenting consent, data minimization, or privacy boundaries. In a memory skill, this can cause inadvertent collection and persistence of sensitive user data across sessions, increasing exposure and misuse risk.

Vague Triggers

High

Confidence: 97% confidence
Finding: The trigger rules are extremely broad terms like preferences, identity phrases, numbers, dates, amounts, and emotional descriptions, which are common in ordinary conversation. This makes unintended activation and over-collection likely, causing the system to persist large volumes of sensitive or irrelevant data without a clear user action.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script prints detected memory content and prior conflicting memory snippets to stdout, which can expose personal conversation data in logs, consoles, or upstream tooling that captures command output. Because this is a memory system handling user profile data, such disclosure can leak sensitive information outside the intended storage boundary.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script persists arbitrary memory content, tags, and context to disk automatically, but provides no user-facing notice, consent check, retention control, or sensitivity filtering. In a memory skill, this can cause unintentional storage of sensitive cross-session data such as personal details, secrets, or confidential context, increasing privacy and data-handling risk.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The code overwrites the JSON index file with serialized memory metadata without any transparency or confirmation to the user. Because the index duplicates stored content and organizes it for retrieval, it can compound privacy exposure and create a second sensitive artifact on disk that may be accessed, backed up, or leaked unexpectedly.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The auto_session flow analyzes an entire conversation and then persists extracted content automatically, with no explicit opt-in, confirmation, or privacy notice at the point of collection. In a memory skill, this is especially risky because users may reveal sensitive personal details during normal conversation and not expect them to be written to disk for cross-session retention.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The capture command appends user-provided content directly into markdown memory files and passes it into index storage without any explicit disclosure that persistent file writes occur. This creates a privacy and transparency issue because users may assume the data is transient when it is actually stored on disk for later retrieval.

Ssd 3

High

Confidence: 98% confidence
Finding: The skill directs end-of-session processing of the entire conversation and persistence of extracted content without clear minimization, consent, or sensitivity screening. That creates a significant privacy risk because personal, confidential, or regulated data may be stored simply because it appeared in the dialogue.

Ssd 3

High

Confidence: 97% confidence
Finding: The repeated emphasis on being fully automatic and triggerless promotes continuous collection of user statements across sessions. In the context of a memory skill, this makes the design more dangerous because the capability is persistence-oriented, so overbroad defaults directly translate into long-term privacy exposure.

Ssd 3

High

Confidence: 98% confidence
Finding: The auto-capture rules target preferences, emotions, evaluations, and recurring numbers or dates, all of which can be highly sensitive or identifying when aggregated over time. Storing this from routine conversation enables unintended profiling and increases harm if the memory store is later exposed or reused out of context.

Ssd 3

High

Confidence: 99% confidence
Finding: The skill instructs retention and summarization of all conversation content, including inferred preferences and emotional state, which creates a strong natural-language data leakage surface. Because the data includes derived personal traits and broad conversational context, any later retrieval, prompt injection, logging exposure, or cross-session use could reveal private information the user never explicitly asked to store.

Ssd 3

High

Confidence: 97% confidence
Finding: Instructions to process all words spoken by the user and update memory/log files amount to broad surveillance-style logging of user inputs. In a memory skill context, this is especially dangerous because the functionality normalizes indiscriminate collection and persistence of user content, which can later be exposed through search, summaries, debugging, or compromise of storage.

Ssd 3

High

Confidence: 98% confidence
Finding: The daily review of all dialogue records and ongoing updates to persistent logs institutionalize continuous accumulation of private user data over time. This raises both privacy and security risk because long-term archives become richer targets for leakage, abuse, and unintended secondary use, especially when they include sensitive patterns, historical context, and inferred attributes.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The guide explicitly supports storing highly sensitive categories such as personal details and investment records in persistent memory. Retaining this information across sessions without clear classification, access control, or retention restrictions raises the risk of privacy harm, profiling, and unauthorized disclosure.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.