Ling Mem

• Analyzed: May 12, 2026, 3:01 PM
• Findings: 1
• Version: 0.5.1
• Hash: 8daab241d5a2057348235e264c056e22f74c1455574a9549006ab1f4c371268f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The ling-mem skill implements a sophisticated cross-session memory system that requires high-risk permissions and behaviors to function. Key indicators include the `install.sh` script, which downloads and executes a prebuilt binary from GitHub and installs a `UserPromptSubmit` hook (`scripts/hooks/recall.sh`) that intercepts every user prompt to inject RAG-retrieved context. While these actions are aligned with the stated purpose of 'auto-recall' and the documentation in `references/routing-rules.md` explicitly forbids storing secrets, the automated modification of agent configuration and the execution of external binaries (IOC: github.com/linggen/linggen-memory) represent a significant attack surface and persistence mechanism.