Memoria

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:33 PM UTC
• Version: 0.2.1

Overview

Memoria is a real memory and Notion-sync tool, but it over-collects sensitive conversation data, auto-syncs it, and has filesystem and token-handling weaknesses users should review carefully.

Install only if you are comfortable with an agent persistently recording conversation details and possibly syncing them to a user-configured Notion workspace. Before use, remove the proactive capture guidance, avoid storing secrets, health data, and third-party personal details, keep Notion auto-sync off unless explicitly needed, rotate any token entered on the command line, and fix the vault path validation issue.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:36

Finding

Proactive collection and automatic export of sensitive conversational data

Content

View full analysis

" # mid-session save memoria sleep "

" --next "" # end session, write handoff ``` ## Storing Memories ```bash memoria remember "" --content "<details>" memoria sync --push # always sync after storing ``` ``` `SKILL.md:36-61`: ```markdown ### What to capture (proactively, without being asked) | Signal | Type | |--------|------| | Human shares personal info (name, location, health, settings) | `fact` | | A decision is made with reasoning | `decision` | | Human says "I prefer / always / never..." | `preference` | | An insight or lesson emerges | `lesson` | | A promise, goal, or deadline is set | `commitment` | | A person is mentioned with context | `relationship` | | An ongoing project is discussed | `project` | **If in doubt, store it.** Better to have a memory you never look up than to forget something. ### Proactive capture triggers Listen for these patterns and store immediately: - "I always...", "I never...", "I prefer..." -> `preference` - "Let's go with...", "We decided...", "The plan is..." -> `decision` - "I learned that...", "Turns out...", "The trick is..." -> `lesson` - "My name is...", "I take...", "I live in...", "I work at..." -> `fact` - "I need to...", "I promised...", "By next week..." -> `commitment` - "Talk to Alice about...", "Bob said..." -> `relationship` - "We're building...", "The project ...[truncated 3727 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/lib/vault.ts:50

Finding

Path traversal allows Markdown file access outside the configured vault

Content

View full analysis

{ const slug = slugify(options.title); const filePath = join(vaultPath, options.category, `${slug}.md`); const relPath = relative(vaultPath, filePath); if (!options.overwrite) { let exists = false; try { await stat(filePath); exists = true; } catch { // file does not exist, safe to write } if (exists) { throw new Error(`Document already exists: ${relPath}. Use --overwrite to replace.`); } } const raw = serializeDocument({ title: options.title, content: options.content, frontmatter: options.frontmatter, tags: options.frontmatter?.tags as string[] | undefined, }); await mkdir(dirname(filePath), { recursive: true }); await writeFile(filePath, raw, 'utf-8'); return parseDocument(raw, relPath, options.category); } ``` `src/lib/vault.ts:84-96`: ```ts export async function getDocument( vaultPath: string, id: string, ): Promise { let filePath = join(vaultPath, id); if (extname(filePath) !== '.md') filePath += '.md'; const raw = await readFile(filePath, 'utf-8'); const parts = relative(vaultPath, filePath).split('/'); const category = parts.length > 1 ? parts[0] : 'inbox'; return parseDocument(raw, relative(vaultPath, filePath), category); } ``` `src/lib/vault.ts:98-127`: ```ts export async function listDocuments( vaultPath: string, category?: string, ): Promise { const config = await readConfig(vaultPath); const categories = category ? [categ ...[truncated 4100 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/lib/config.ts:16

Finding

Notion bearer token is accepted on the command line and persisted in plaintext

Content

View full analysis

; } ``` `src/commands/setup-notion.ts:6-32`: ```ts export async function setupNotionCommand( options: { token: string; page: string; vault?: string }, ): Promise { if (!options.token || !options.page) { console.log(chalk.red('Both --token and --page are required.')); console.log(chalk.dim('Usage: memoria setup-notion --token --page ')); process.exit(1); } const config = await resolveVault(options.vault); const client = createNotionClient(options.token); try { await client.pages.retrieve({ page_id: options.page }); } catch (err) { console.log(chalk.red('Failed to access Notion page. Check your token and page ID.')); console.log(chalk.dim(err instanceof Error ? err.message : String(err))); process.exit(1); } config.notion = { token: options.token, rootPageId: options.page, }; config.autoSync = true; await writeConfig(config); ``` `src/lib/config.ts:16-19`: ```ts export async function writeConfig(config: VaultConfig): Promise { const filePath = configPath(config.path); await writeFile(filePath, JSON.stringify(config, null, 2) + '\n', 'utf-8'); } ``` `src/cli/index.ts:98-104`: ```ts program .command('setup-notion') .description('Configure Notion integration') .requiredOption('--token ', 'Notion integration token') .requiredOption('--page ', 'Root Notion page ID') .option('-v, --vau ...[truncated 2178 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (46)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill enables automatic Notion sync after storing memories but does not prominently warn that user data will be transmitted to a third-party service. Because this skill is designed to persist user memories, silent or default remote transmission materially increases confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

These agent instructions direct proactive capture of sensitive personal information, including health and personal details, and then instruct syncing after storage. That combination of unsolicited persistence plus outbound transfer creates a substantial privacy and data-handling vulnerability, especially because the agent is told not to wait to be asked.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instructions explicitly encourage storing highly sensitive user data such as health details and personal facts without any consent, minimization, retention, or privacy warning. In a memory skill with persistence and optional remote sync, this creates a real risk of collecting protected or intimate information beyond user expectations and exposing it to later misuse or leakage.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The proactive capture triggers operationalize automatic logging of sensitive user statements into persistent memory from normal conversation. In the context of a long-term memory system, this is especially dangerous because it scales inadvertent surveillance-like retention across many interactions and can create durable privacy harm if exposed or synced externally.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README explicitly tells agents to store highly sensitive categories of user information, including health data and credential-related context, without requiring user consent, minimization, or exclusions for secrets. In a memory skill that also supports Notion synchronization, this creates a clear risk of persistent retention and third-party propagation of sensitive data beyond the immediate conversation.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This skill is specifically designed as a structured memory system with local retention and two-way Notion sync, so instructions to retain facts about health, relationships, preferences, and credential-related context materially increase privacy and security risk. The combination of indiscriminate retention plus automatic external sync can lead to unauthorized long-term storage, broader exposure, and accidental disclosure of sensitive user information.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code chunk does not implement a structured memory system. It only parses Markdown into Notion block request objects and serializes Notion-style blocks back into Markdown. While this could be a supporting utility for a larger Notion sync feature, in isolation its actual behavior is a text/block conversion helper, not memory storage, retrieval, search, session management, or synchronization. Therefore the declared description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description describes a full memory-management skill with storage, retrieval, session controls, and Notion sync. The provided code chunk does none of that; it only configures the Vitest test runner by setting globals to true and specifying which test files to include. This is a materially different primary purpose and is unrelated to the declared functionality.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is designed to activate on very broad signals such as any user desire to store, recall, search, or share important information, and then encourages proactive capture. In a memory skill, this context makes over-triggering particularly dangerous because unintended activation can lead to silent retention of personal or sensitive data beyond the user's expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill explicitly tells the agent to capture personal information such as name, location, health, and work details proactively and says 'If in doubt, store it' without any warning, consent flow, retention notice, or privacy constraints. This is dangerous because it normalizes collection of sensitive data without informed user approval and can create persistent privacy harm if retained or later exposed.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The instructions direct proactive collection and retention of personal and potentially sensitive user information without requiring an explicit request from the user. In the context of a memory skill, this materially increases the risk of over-collection, long-term retention, and secondary disclosure of sensitive data that the user never intended to persist.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The pattern-matching triggers instruct immediate storage when users mention phrases like 'My name is...', 'I take...', or 'I live in...', which can include highly sensitive data such as health and location. This is dangerous because the automation bypasses deliberation and consent, making it easy to persist sensitive disclosures the moment they are uttered.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==2.0.2 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

brace-expansion 2.0.2 is a real supply-chain risk because known DoS issues in brace parsing/expansion can be triggered by attacker-controlled glob-like patterns. In this lockfile it is only a transitive dependency, but if the skill accepts user-controlled patterns or file selectors through glob/minimatch flows, this can cause CPU or memory exhaustion rather than direct code execution.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 89% confidence

Finding

form-data 4.0.5 has a CRLF injection issue in multipart field names, which can corrupt HTTP multipart requests or enable header/body manipulation when attacker-controlled names are used. Here it is transitively pulled by @types/node-fetch rather than obviously used directly, so exploitability in this skill is limited but the vulnerable package is genuinely present.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==3.14.2 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

js-yaml 3.14.2 has multiple CPU-exhaustion issues involving crafted YAML structures such as merge keys and omap handling. Because this skill includes gray-matter, which commonly parses front matter from Markdown files, hostile memory documents or synced content could realistically trigger parser-level denial of service.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: minimatch==9.0.5 — 3 advisory(ies): CVE-2026-27904 (minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regu); CVE-2026-26996 (minimatch has a ReDoS via repeated wildcards with non-matching literal in patter); CVE-2026-27903 (minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adja)

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

minimatch 9.0.5 has known ReDoS/backtracking issues that can be triggered with malicious glob patterns. This matters in a memory-management skill because file discovery and search features often accept path or pattern input, making denial of service plausible if untrusted patterns are processed.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)

High

• Category: Supply Chain
• Confidence: 83% confidence

Finding

nanoid 3.3.11 has reported issues that can lead to infinite loops or integer-related failures in edge cases such as invalid size values or custom generators. In this lockfile it is a dev/transitive dependency under postcss, so it is a real vulnerable component but unlikely to affect runtime behavior of the skill unless build tooling processes attacker-controlled inputs.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: picomatch==4.0.3 — 2 advisory(ies): CVE-2026-33672 (Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Mat); CVE-2026-33671 (Picomatch has a ReDoS vulnerability via extglob quantifiers)

High

• Category: Supply Chain
• Confidence: 86% confidence

Finding

picomatch 4.0.3 has known issues including ReDoS and incorrect matching via method injection in POSIX character classes. Here it appears only in dev tooling paths, so the package itself is vulnerable, but exploitation against end users of the skill is less likely unless untrusted glob patterns are handled during build/test workflows.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: postcss==8.5.6 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more

High

• Category: Supply Chain
• Confidence: 84% confidence

Finding

postcss 8.5.6 has reported issues including arbitrary file read and output-encoding problems in specific processing scenarios. In this lockfile it is a dev dependency used by vite/tsup-related tooling, so it is a genuine vulnerable component, but there is limited evidence that the skill runtime exposes CSS processing to attackers.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: rollup==4.58.0 — 1 advisory(ies): CVE-2026-27606 (Rollup 4 has Arbitrary File Write via Path Traversal)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

rollup 4.58.0 has a reported arbitrary file write/path traversal issue, which is serious when untrusted archives, plugin inputs, or output paths are handled by the bundler. In this case rollup is present in dev tooling, so the vulnerable package is real, but exposure depends on whether builds consume attacker-controlled project content or plugin configuration.

Content

No source excerpt is available for this finding.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · src/lib/sync-state.ts (reported line 51)May include surrounding context.

ts

}

export function removeEntry(state: SyncState, localPath: string): void {
  delete state.entries[localPath];
}

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The instruction 'If in doubt whether something is worth storing, store it' removes any meaningful boundary on collection and pushes the agent toward over-retention. In a memory product, this broad default encourages storage of incidental, unnecessary, and potentially sensitive information that the user did not intend to persist.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger phrases map common conversational statements directly into persistent memory categories, which makes accidental collection likely during ordinary dialogue. Because these patterns include personal identity, relationships, commitments, and preferences, they can cause the agent to persist context users may have shared only transiently.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions encourage blanket collection with phrases like 'Store important information immediately,' 'After storing, always sync,' and 'If in doubt whether something is worth storing, store it.' That removes meaningful sensitivity filtering and opt-in, making overcollection likely and causing agents to persist user data that should remain ephemeral.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill instructs use of shell commands and environment variables (export MEMORIA_VAULT=~/memory) but does not declare an explicit tool scope or allowed-tools boundary. That increases the risk that an agent may execute commands or modify environment state without clear authorization or review, especially in frameworks that rely on manifest scoping for safety.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.