Security audit

Memory Tree Pipeline

Security checks across malware telemetry and agentic risk

Overview

This memory-management skill is not clearly malicious, but it can persistently rewrite or delete agent memory with limited disclosure and safeguards.

Install only if you are comfortable giving it control over your local agent memory tree. Back up the memory workspace first, run migration and sealing in dry-run mode where available, confirm the configured paths, and avoid the forget/source-deletion path unless you have a separate recovery copy.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises no declared permissions while its documented behavior and detected capabilities imply environment access plus filesystem read/write operations. This creates a transparency and consent problem: an agent or operator may invoke the skill without understanding that it can inspect, create, modify, back up, or delete local memory files.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The manifest describes a memory-organization skill, but the broader behavior includes migration, backup creation, recall/search, rebuilding indexes, integrity verification, and forgetting/removing summaries with optional source deletion. This mismatch can mislead users and orchestration systems about the true operational scope, increasing the risk of unintended destructive file operations and overbroad access to stored agent data.

Intent-Code Divergence

Medium

Confidence: 83% confidence
Finding: The docstring promises idempotence and that original data is preserved, but reruns can overwrite generated global files, which can destroy prior migrated or manually edited content. In a memory-management skill, this mismatch is more dangerous because users may trust the safety guarantees and run the script repeatedly on important long-lived agent memory.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger phrase is broad enough to activate on generic conversations about memory, summarization, or topic extraction, which raises the chance of accidental invocation. In a skill that can read and write memory files, unintended activation can expose stored content, alter memory state, or launch maintenance actions in contexts where the user did not intend file operations.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/test_memory_tree.py:27