Security audit

Dory-Proof Memory System

Security checks across malware telemetry and agentic risk

Overview

This is a transparent local memory template, but it deliberately stores task wording and work history in files users should keep free of secrets.

Install only in workspaces where persistent local memory is desired. Do not put passwords, API keys, regulated data, confidential client material, or sensitive personal details into tasks that will be written to these files. Periodically review or clear ACTIVE.md, USER.md, MEMORY.md, recent-work logs, and archived memory files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly instructs agents to persist the user's exact words immediately, before interpretation, with no consent flow, minimization rule, or filtering for secrets, credentials, or regulated data. In a memory skill, this makes accidental retention of sensitive user input highly likely and increases exposure through later reads, backups, sync, or sharing of the workspace.

Ssd 3

Medium

Confidence: 96% confidence
Finding: Requiring verbatim persistence of all user input creates a systematic data retention channel for natural-language secrets and sensitive context. Because the instruction is mandatory and immediate, it bypasses judgment about whether the content should be stored at all, making over-collection and downstream leakage materially more likely.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The documented file format normalizes storing exact user quotes in a persistent workspace file, reinforcing unsafe handling as part of the standard operating procedure. This is dangerous because examples in skills strongly shape agent behavior, and the format provides no caveat about redaction, consent, or limiting what gets written.

Ssd 3

Medium

Confidence: 88% confidence
Finding: Including a persistent USER.md profile as a standard workspace component encourages ongoing accumulation of user information without defined scope or safeguards. In context, this memory system is specifically designed for long-lived continuity, so profile data can silently expand over time into a privacy and confidentiality risk.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The guide explicitly instructs agents to persist the user's exact words to `state/ACTIVE.md` before any interpretation. That creates a direct data-retention channel for potentially sensitive prompts, credentials, personal data, or regulated content, and increases the chance of later disclosure through logs, workspace sharing, backups, or subsequent agent reads.

Ssd 3

Medium

Confidence: 91% confidence
Finding: The boot sequence and maintenance flow require agents to continually read and update `recent-work.md`, daily logs, and decision/state files, which can accumulate sensitive user-derived information over time. In a memory skill whose purpose is cross-session persistence, that accumulation is especially risky because data becomes broadly available to future sessions and agents beyond the original need-to-know scope.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.