Security audit

Triple Memory

Security checks across malware telemetry and agentic risk

Overview

This is a coherent memory skill, but it silently and automatically stores user and workspace context with weak user visibility and scope controls.

Install only if you intentionally want automatic persistent memory. Before use, remove or override the silent-operation instructions, disable auto-capture or auto-flush for sensitive work, define excluded paths and data categories, confirm what is sent to the embedding provider, and make sure stored memories can be reviewed and deleted.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger phrases for automatic memory capture are so broad that ordinary conversation can be persisted without clear user intent. This increases the chance that sensitive preferences, personal facts, or incidental statements are stored across sessions unexpectedly.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The skill directs automatic memory storage and file updates without user-facing notice, removing transparency around persistence of user data. Silent persistence makes it difficult for users to understand what is being retained, contest storage, or avoid disclosure of sensitive information.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The instruction to never announce memory operations actively conceals data retention behavior from users. Concealment materially worsens privacy risk because users cannot make informed decisions about sharing sensitive information or verify where it was stored.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The setup explicitly enables `autoRecall` and `autoCapture`, and the AGENTS.md template instructs a silent `sync --start`, but the documentation does not warn that user/workspace content may be persisted, surfaced automatically in later sessions, or transmitted to external embedding services via the configured API key. In a memory skill, this is contextually more dangerous because automatic capture/recall is the core feature and may collect sensitive decisions, prompts, secrets, or proprietary workspace data without informed consent or clear boundaries.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The auto-flush trigger is described only as 'Session nearing compaction' and '~80%' context usage, without clear scope limits on what content may be summarized or persisted. In a memory skill that automatically writes to files, git-notes, and LanceDB, this ambiguity can cause sensitive or irrelevant session data to be stored without deliberate review, increasing unintended retention and disclosure risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This configuration enables automatic memory writes and capture ('memoryFlush.enabled', 'autoRecall', and 'autoCapture') but shows no visible disclosure, notice, or consent mechanism for the user. In a persistent multi-backend memory system, silent collection and storage can expose sensitive prompts, decisions, credentials, or personal data across sessions and systems, making the risk more serious in this skill context.

Missing User Warnings

Low

Confidence: 96% confidence
Finding: The script uses a predictable path in `/tmp` (`/tmp/clawdbot-filesearch.txt`) and then deletes and recreates it via shell redirection. An attacker on the same system could pre-create that path as a symlink or manipulate it between operations, potentially causing unintended file overwrite or deletion in the context of the script's privileges.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The skill promotes silent retention of conversation details across sessions through auto-recall and auto-capture, which can preserve user data beyond the immediate interaction without visibility. In a memory skill this behavior is contextually related to its purpose, but it is still dangerous without minimization, consent, and sensitive-data handling.

Ssd 3

Medium

Confidence: 91% confidence
Finding: The pre-compaction memory flush instructs the agent to summarize and preserve session context automatically into persistent stores, which can sweep up sensitive user inputs that were never intended for long-term retention. Because compaction happens operationally rather than conversationally, users may have no visibility that this archival step occurred.

Ssd 3

High

Confidence: 98% confidence
Finding: Concealing persistence actions while continuing to store user information creates a clear privacy and trust violation. The combination of hidden operation and durable retention raises the likelihood of unnoticed collection of personal, proprietary, or regulated data.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.