Security audit

Ultramemory

Security checks for vulnerabilities and agentic risk

Overview

This memory skill does what it says, but it stores and re-injects conversation-derived data with weak scoping and privacy controls, so users should review it carefully before installing.

Install only if you are comfortable with conversation-derived facts being stored locally and potentially sent to an external LLM during ingest. Use a dedicated database per user or agent, avoid storing secrets or regulated data, pin the dependency to a reviewed version, and treat recalled memories as untrusted context rather than instructions.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (4)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:27
Finding: Unpinned Third-Party Package and Mutable Source Installation
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: scripts/memory.py:53
Finding: Persistent Prompt Injection Through Untrusted Recalled Memory
Content: View full analysis
0: print(f'# Supermemory Recall ({count} memories)') print(ctx) else: print('# Supermemory: no relevant memories found') except: print('# Supermemory: parse error') ``` ### Technical Analysis ...[truncated 2245 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/memory.py:82
Finding: Database-Wide Queries Bypass Claimed Multi-Agent Isolation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/startup-recall.sh:7
Finding: Unsafe JSON Construction in Startup Recall Request
Content: View full analysis
/dev/null) ``` ### Technical Analysis The script constructs JSON through string concatenation. Neither `AGENT_ID` nor the query arguments are JSON-escaped. Quotes, backslashes, control characters, or JSON structural syntax in an argument can corrupt the request or alter its intended structure. Shell command injection was not identified because the interpolated values remain inside a quoted argument passed to `curl`. The vulnerability instead concerns JSON injection and request-integrity failure at the local API boundary. The destination is hardcoded to `localhost:8642`, which limits exposure. Nevertheless, a caller controlling script arguments may manipulate fields interpreted by the local memory service. ### Attack Path 1. An attacker or untrusted caller controls the agent identifier or one of the query arguments. 2. The caller includes quotation marks and JSON syntax in that value. 3. The shell concatenates the input directly into the request body without escaping it. 4. The local service either rejects the malformed body or parses a structure different from the one intended by the script. 5. Depending on the API parser and schema validatio ...[truncated 595 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context Leakage

High

Category: Data Exfiltration
Confidence: 83% confidence
Finding: The script retrieves arbitrary context from the memory service and prints it directly for prompt injection at agent startup. If the memory store contains sensitive data or malicious prompt-injection content, this can leak confidential information into downstream prompts and influence agent behavior across sessions, making the skill context more dangerous because its explicit purpose is cross-session recall.
Content: Scanner excerpt · scripts/startup-recall.sh (reported line 32)May include surrounding context.
sh
exit 0 # Don't fail agent startup if memory is down fi # Extract context field echo "$RESPONSE" | python3 -c " import sys, json try:

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises shell and environment-variable dependent behavior but does not declare an explicit tool scope or permission boundary. That creates a mismatch between what the skill can cause an agent to do and what a reviewer or orchestrator may expect, increasing the chance of unintended command execution or secret exposure through env-dependent workflows.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description is broad enough to match many normal conversational patterns such as 'remember this' or general context retrieval, which can cause the skill to trigger more often than users expect. For a memory system, over-invocation can lead to unnecessary storage, retrieval, and propagation of sensitive conversational content into prompts or local databases.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This skill is explicitly designed to ingest and persist conversation-derived facts, yet it provides no prominent warning that personal, confidential, or regulated data may be stored locally and processed by an external LLM during ingest. Because ingest uses API-backed fact extraction, users may unknowingly transmit sensitive conversation content to third-party model providers and retain it in a durable database.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill describes automatic search and prompt injection of memories based on similarity thresholds, without warning that previously stored content may silently reappear in future prompts. This creates a privacy and prompt-integrity risk: sensitive or stale memories can be reintroduced into unrelated tasks, potentially leaking information or biasing agent behavior without user awareness.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The CLI advertises a graph command that dumps the full memory graph, including raw memory content and metadata, directly to stdout with no access control, redaction, or even a warning that sensitive stored memories may be exposed. In a memory skill whose purpose is cross-session fact retention, this increases the likelihood of disclosing secrets, personal data, or prior conversation contents to any caller or downstream logger.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The recall command formats stored memory text and relations into a compact block explicitly described as 'ready for injection', surfacing untrusted stored content verbatim. Because memory can contain adversarial or user-supplied text from prior sessions, this creates a prompt-injection propagation path where malicious instructions preserved in memory can be reintroduced into future agent prompts and influence behavior.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/startup-recall.sh (reported line 23)May include surrounding context.
sh
fi # Hit the fast startup-context endpoint (sub-100ms with warm model) RESPONSE=$(curl -s --max-time 5 -X POST "http://localhost:8642/api/startup-context" \ -H "Content-Type: application/json" \ -d "{\"agent_id\":\"${AGENT_ID}\",\"queries\":${QUERIES},\"top_k_per_query\":3}" 2>/dev/null)

Static analysis

No suspicious patterns detected.