Memory

• Outcome: Pass
• Latest audit: Jul 26, 2026 · 2:00 PM UTC
• Version: 1.0.7

Overview

This skill stores and manages local plaintext memory files as advertised, with no evidence of hidden network access or deceptive behavior.

Install this only if you want an agent to keep long-lived facts in plaintext markdown on your machine. Do not store secrets in it, consider using git or another backup before large maintenance or migration operations, and keep delete_policy set to confirm if you want an explicit go-ahead before removals.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill advertises very broad trigger phrases such as 'save this', 'don't forget', and general recall prompts, which can cause the agent to invoke a file-writing/deletion capability in situations where the user may not expect durable local storage. In this context, unintended invocation increases privacy and integrity risk because the skill can persist sensitive personal facts or later delete records based on ambiguous language.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The skill performs local writes, updates indexes, and may purge files and links, but the early user-facing guidance does not prominently foreground that using the skill changes plaintext files on disk and can delete stored data. That omission can undermine informed consent, especially because the store contains durable personal information and the skill is instructed to write before replying.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly instructs the agent to persist user facts to a durable markdown store, including by default when the user says to remember something, but it does not require any user-facing disclosure about retention, visibility, or privacy consequences. This is risky because users may provide sensitive personal, organizational, or decision data without understanding that it will be stored long-term in plaintext-like local files and potentially recalled later outside the immediate session.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documented bulk rename workflow performs an in-place move followed by a recursive search-and-replace across the entire memory store, which can modify many files at once and is easy to misuse if the match scope is broader than expected. Although the text includes a caution to preview the grep results first, it does not require an explicit confirmation gate or safer staged process before executing the destructive edit, so an agent or operator could still corrupt links or content at scale.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The maintenance guidance includes destructive operations like filing or deleting items as part of routine cleanup, but it does not present an immediate warning at the point of action about data loss, confirmation, or recovery options. In a memory-management skill that operates on user-authored durable data, normalizing deletion without guardrails can lead an agent or user to remove valuable information irreversibly.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The instruction to delete facts that 'turned out wrong' encourages permanent data removal without coupling it to backup, confirmation, or an audit trail. Wrong data in a memory store may still have forensic or historical value, and deleting it outright can destroy context needed to understand later contradictions or recover from mistakes.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: In the staleness sweep, classifying content as 'wrong' leads directly to deletion, again without a nearby safety warning or recovery procedure. Because this step is embedded in a recurring maintenance process, it increases the chance of habitual destructive edits based on imperfect judgment, stale evidence, or misclassification.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The `mv` example demonstrates direct mutation of the user's memory store and related index updates, but it does not warn that the operation changes persistent data and may complicate recovery if done incorrectly. In a skill meant to manage long-lived knowledge, even routine moves can orphan references, lose history, or create inconsistency without safeguards.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This instruction directs the agent to persist user information immediately into a durable store, but the file itself does not require an explicit confirmation or warning that persistent user data is being modified. In a memory skill, persistent writes are expected behavior, yet silent or automatic writes increase the risk of storing sensitive, incorrect, or unintended data beyond the current session.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly directs the agent to create directories and write files under the user's home directory on first use, but it does not require an explicit user-facing confirmation immediately before those filesystem changes. Because this is durable state outside built-in memory, an agent could perform writes the user does not fully expect, especially when the trigger is a natural-language request like 'remember this.'

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The migration section instructs the agent to move existing data and delete an old config file, which are potentially destructive operations, without requiring confirmation, backup, or validation of ownership and path safety. If triggered incorrectly, this could overwrite, relocate, or remove user data and make recovery difficult.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.