Security audit
Mori Relationship Memory
Security checks across malware telemetry and agentic risk
Overview
The skill is a disclosed connector for Mori relationship-memory data, with sensitive access that fits its stated purpose but should be configured carefully.
Install only if you intend to give Mori access to private relationship, contact, email-thread, and optional SMS-derived data. Use the stated read + ask API-key preset, verify the MCP package/source before running the npx command, and remember that POST retrievals may create saved graph questions even though the skill says it does not auto-send emails or introductions.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.