Security audit

Xiaolongxia Memory Manager

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local memory-management skill, but it will create persistent records of conversations and preferences if installed as written.

Install only if you want persistent local memory across sessions. Review the generated MEMORY.md and memory/*.md files, keep them out of version control or shared sync unless intentional, and do not store secrets, credentials, regulated data, or highly sensitive personal details there.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill explicitly tells the assistant to automatically write conversation takeaways to a daily memory file after 'valuable' conversations, but provides no requirement to notify the user, obtain consent, or exclude sensitive data. This creates a real privacy and retention risk because personal details, project context, or secrets may be persisted across sessions without the user's awareness.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The setup instructions direct creation and ongoing modification of MEMORY.md, heartbeat state, and dated memory files in the workspace, but do not include an explicit warning that the skill will write persistent artifacts. In a file-writing agent environment, silent persistence can surprise users, leak sensitive context into the repository/workspace, and create unintended retention or syncing exposure.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The template explicitly instructs the assistant to proactively persist user conversation content, decisions, and preferences to disk without any requirement to notify the user, obtain consent, or apply data-minimization rules. This creates a real privacy and compliance risk because sensitive personal or project information may be stored and later resurfaced across sessions beyond the user's expectations.

Ssd 3

Medium

Confidence: 97% confidence
Finding: These instructions tell the assistant to proactively persist user conversation details and project context immediately after useful conversations, without any consent flow or filtering rules. That is dangerous because it normalizes automatic cross-session retention of potentially sensitive user information, increasing the chance of later disclosure or misuse.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The long-term memory guidance explicitly encourages retaining user background, goals, communication preferences, and recurring topics, all of which can be private and can enable profiling across sessions. Without minimization, consent, and sensitivity checks, this creates a sustained privacy risk and increases the blast radius if the memory file is exposed or later surfaced in unrelated conversations.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The prompt tells the assistant to 'actively record' valuable conversation outputs and user preferences immediately, then use them for future continuity. That is a true retention/resurfacing vulnerability because it normalizes silent cross-session persistence of user-provided information, which can expose confidential details in later contexts or to unintended operators sharing the same workspace.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The long-term memory section specifically instructs persistence of user background, goals, communication preferences, project status, and recurring patterns. In a memory-management skill, this context makes the behavior intentional, but it also makes the risk more concrete because the skill's core purpose is to accumulate and reuse profile-like data over time, increasing privacy, profiling, and accidental disclosure risk.

Static analysis

No suspicious patterns detected.