Security audit

Bulletproof Memory 1.0.0

Security checks for vulnerabilities and agentic risk

Overview

This memory skill openly tries to persist and reload agent context, but it does so automatically and too broadly for private user details.

Install only if you deliberately want automatic local memory. Before using it, add your own rules requiring consent, excluding secrets and sensitive personal data, limiting which files may be read, and providing a way to inspect, redact, and delete stored memory.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:67
Finding: Automatic Plaintext Persistence of Potentially Sensitive User Details
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:111
Finding: Unconditional Startup Access to Identity and Historical Memory Files
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The WAL design requires persisting concrete user details immediately and repeatedly across sessions, but it does not restrict sensitive categories or define retention boundaries. In practice, that can cause accumulation of personal data, corrections, locations, names, and other private details beyond what is necessary for task completion.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to create and automatically update a persistent workspace file with user-provided details before responding, but it provides no user notice, consent flow, or sensitivity limits. This creates a real privacy and data-governance risk because personal or confidential information may be stored durably and accessed later without the user's awareness.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The recovery and startup instructions tell the agent to automatically read identity and memory files without permission to reconstruct context. This increases exposure of stored private data because the agent may pull in unrelated historical or identity information simply because a trigger fired, not because the user authorized or needed it for the current request.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The startup sequence directs the agent to automatically read SESSION-STATE.md, identity files, and recent memory files on every session, explicitly saying not to ask permission. This is dangerous because it normalizes silent access to potentially sensitive local data and may expose prior-session personal information unrelated to the current task.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The memory flush protocol encourages writing 'everything important' and producing comprehensive handoffs as context grows, which promotes over-collection and persistence of user information. Without sensitivity filters, this can capture excessive personal, confidential, or irrelevant data and make later exposure more harmful.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.