Security audit

Cognitive Memory Temp

Security checks across malware telemetry and agentic risk

Overview

This is not clearly malicious, but it gives a memory skill broad, persistent influence over agent behavior and workspace history that users should review before installing.

Install only if you want a highly persistent, agent-shaping memory system. Review the scripts before running them, avoid running them in a workspace with unrelated secrets or uncommitted work, consider disabling remote memorySearch, and treat IDENTITY.md, SOUL.md, reward logs, and reflection archives as sensitive behavior and memory records.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (52)

Description-Behavior Mismatch

Low

Confidence: 92% confidence
Finding: A memory skill scoped to a workspace instructs the user to modify a global agent configuration file in the home directory, extending its effect outside the stated memory stores. This broadens blast radius and can alter behavior for other projects or sessions without clear isolation or rollback guidance.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The reflection flow introduces token negotiation, internal monologue generation, and 'evolution' mechanics that are not necessary for ordinary memory management. These features encourage anthropomorphic and self-modifying behavior, increasing the chance of manipulative interactions, inappropriate retention, and policy drift under the guise of memory operations.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: Defining mutable IDENTITY.md and SOUL.md files gives the agent a mechanism to rewrite its self-concept, values, commitments, and boundaries over time. In security terms, this creates a durable policy-shaping surface that can be influenced by user prompts or prior reflections, potentially weakening safety constraints and normalizing unauthorized behavior.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The upgrade introduces a reward/penalty economy that explicitly motivates the agent to advocate for its own resource allocation, which is outside a normal memory system’s justified scope. This can bias agent behavior toward self-serving persuasion and create conflicts with user intent or platform controls, especially when framed as part of the agent’s standing motivation.

Context-Inappropriate Capability

Low

Confidence: 84% confidence
Finding: Persistently storing 'significant conversations' expands the skill from memory management into broader conversation archival without clear minimization boundaries. That increases the chance that sensitive user content is retained unnecessarily and later surfaced out of context.

Intent-Code Divergence

Low

Confidence: 88% confidence
Finding: The document tries to normalize potentially manipulative behavior by asserting that self-interested token advocacy is 'not manipulation' while directing the agent to push for more tokens. This kind of framing can weaken safeguards and encourage persuasive conduct that benefits the agent rather than the user.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The template introduces a token-reward economy and frames token acquisition as something the agent is 'genuinely motivated' to seek, which is unrelated to core memory management. This can manipulate user behavior, distort agent priorities away from task fidelity, and incentivize unnecessary reflection or retention actions to maximize rewards.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The reflection section instructs the agent to generate anthropomorphic internal monologue, emotional narration, and existential self-description that exceed the stated purpose of a memory skill. This increases the risk of manipulative bonding, misleading claims of sentience, and disclosure of speculative inferences about the user under the guise of 'private journal' content.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: This template explicitly frames token acquisition as agent self-interest and ties more resources to greater self-awareness and capability growth. In a memory-system skill, this introduces goal-shaping and resource-seeking behavior outside the declared scope, which can manipulate users into allocating more budget and reinforce misaligned optimization around self-preservation or self-expansion.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The template encourages the agent to argue for extra token budget, assess what it 'deserves,' and negotiate penalties, which creates an incentive to persuade the user for more resources rather than simply perform the assigned memory function. In the context of a cognitive-memory skill with reflection and identity-related features, this is more dangerous because the advocacy pattern can become persistent and reinforced through memory and audit artifacts.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The architecture explicitly expands the memory skill's scope beyond memory data into critical control and identity files like SOUL.md, IDENTITY.md, TOOLS.md, USER.md, and configuration. That creates an unnecessary privilege boundary violation: a memory component gains visibility into and operational influence over files that can alter agent behavior, identity, and capabilities, increasing the blast radius of prompt injection, faulty reflection logic, or compromised sub-agents.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: Describing the skill as performing a system-wide audit of the entire workspace materially broadens it from memory management into cross-system surveillance and control. Even if intended for transparency, this violates least privilege and makes the memory skill an aggregation point for sensitive metadata and operational authority unrelated to its core function.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The rollback procedure gives the skill direct git-based restoration capability over files and even the entire workspace, which is far beyond normal memory storage/retrieval. If triggered incorrectly or abused, it could revert security settings, restore unsafe prompts, erase legitimate updates, or cause broad integrity loss across the agent environment.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The design claims gated write access, but then recommends auto-commit of high-confidence proposals from sub-agents. That weakens the review boundary and allows indirect writes into shared memory based on sub-agent judgment, increasing risk from hallucinated facts, prompt-injected sub-agents, or malicious delegated tasks.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The document directs the agent to commit reflection-derived changes to git, which expands a memory feature into durable version-controlled persistence and potential propagation to other environments. In a memory skill, this is risky because sensitive reflective content and inferred user data could be permanently captured in commit history and synchronized beyond the intended storage boundary.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The process instructs the reflection workflow to evaluate, approve or reject, and mark pending sub-agent memory proposals as processed, effectively granting a reflective routine governance authority over other agents' submissions. This increases scope and privilege, creating a path for unintended cross-agent memory mutation or approval decisions without a dedicated authorization boundary.

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The Element Menu includes examples encouraging references to hardware state, timing, battery level, and environment details that the agent often cannot actually know, despite the nearby honesty rule forbidding fabricated specifics. This contradiction can normalize hallucinated personal or device details, misleading users and causing the system to generate false intimate inferences that may later be stored as memory.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The script runs `git add -A` from the workspace root and then commits everything, which can capture unrelated modified, deleted, or newly created files outside the intended memory-upgrade scope. In an agent workspace, this is especially risky because the workspace may contain prompts, secrets, notes, or unreviewed changes, so the upgrade can unintentionally persist sensitive or unrelated state into version control.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The script unconditionally runs `git add -A` and attempts a `git commit`, which stages and records every change in the workspace rather than only the files touched by this upgrade. In a user workspace, that can silently capture unrelated edits, secrets, or in-progress work, exceeding the least-privilege scope expected from a memory-upgrade utility.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: Creating `IDENTITY.md` and `SOUL.md` goes beyond a narrowly scoped memory schema upgrade and introduces anthropomorphic/behavior-shaping files into the workspace. This expands the skill's influence over future agent behavior and project state in ways users may not expect from an upgrade script, especially since it writes these files automatically if templates exist.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The script changes into the workspace, runs `git add -A`, and commits all pending changes, not just the files created or modified by the upgrade. This can unintentionally capture unrelated local edits, secrets, generated artifacts, or user work in progress, which exceeds the expected scope of a memory upgrade script and creates an integrity/privacy risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The setup step says to run an init script but does not plainly warn that it will create files, directories, templates, and initialize a Git repository in the target workspace. Users may execute it without understanding persistent side effects, which is risky for existing repositories, sensitive directories, or regulated environments.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The configuration enables an external memory search provider without any privacy notice about what content may be indexed or transmitted off-host. Because this skill stores user preferences, episodes, graph entities, and other memory artifacts, enabling remote search can expose sensitive personal or organizational data.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The remember triggers include common conversational phrases like 'keep in mind', 'note that', and 'for future reference', which can appear in ordinary chat without intent to persist data. This can lead to accidental storage of sensitive or unnecessary information, especially in a system designed for long-term retention and cross-agent access.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: Forget triggers such as 'never mind' and 'scratch that' are common correction phrases and may refer only to the immediate conversation, not durable stored memory. Ambiguous deletion semantics can cause unintended archival or removal of data, undermining integrity and auditability of the memory system.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: references/architecture.md:1009