Lobster Memory

• Outcome: Review
• Latest audit: Jul 23, 2026 · 8:17 AM UTC
• Version: 0.2.1

Overview

This is a real long-term memory skill, but it automatically saves conversation-derived information for future reuse without enough consent, deletion, or sensitive-data controls.

Install only if you want this agent to maintain durable memory from conversations. Treat the memory file as sensitive, avoid sharing secrets while it is enabled, review install.sh before running it, and plan your own process for inspecting, deleting, or disabling stored memories until the skill provides explicit privacy controls.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares no explicit permissions, yet its instructions clearly direct persistent writes to `.lobster/memory.axeb` in the workspace. This mismatch weakens user and platform visibility into what the skill can do, increasing the chance that conversation data is stored unexpectedly or without proper governance.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The retention policy explicitly protects engine-internal nodes with missing domain/type from normal forgetting, but panic_mode later force-trashes remaining low-scored live vertices without reapplying that protection. In a long-memory engine, deleting internal/root nodes can corrupt graph integrity, break traversal/saves, or cause broad memory loss under pressure, making this a real availability/integrity issue.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README explicitly instructs users to automatically extract and write post-conversation content into long-term memory, but it does not clearly warn that user messages and agent replies may be persisted. In a memory skill, this omission is materially important because operators may store sensitive personal, credential, or business data without informed consent or retention controls.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to automatically extract information from every conversation turn and persist it to long-term storage, but it does not require a meaningful user warning or consent flow. Because the stored content is derived from user messages and assistant replies, this can capture sensitive personal, business, or credential-like information and retain it beyond the current session.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The installation instructions tell users to clone a repository and run `bash install.sh`, which is a classic trust boundary crossing: arbitrary shell code from a remote repository executes on the user's machine. The same section also directs users to set environment variables that control executable paths, increasing risk of path hijacking or accidental execution of untrusted binaries if those values are mis-set or later abused.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The design explicitly persists conversation-derived memories automatically, including preferences, relationships, and summaries, but does not mention consent, retention limits, review/deletion UX, or handling of sensitive data. In a long-term memory skill, this materially increases privacy risk because the system is intended to accumulate personal data over time and inject it back into future prompts.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The installer performs network-dependent package acquisition and executes build/install subprocesses (`git clone`, `pip install`, `maturin develop`) without clearly warning the user up front that it will fetch and execute third-party code. In this skill context, that matters because the downloaded Rust/Python package can run arbitrary install-time code, and the source URL is environment-variable-overridable, increasing supply-chain risk if a user inherits a hostile environment.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script writes a `.pth` file into the venv's `site-packages`, causing the skill directory to be automatically added to Python's import path. That is a meaningful environment modification because it changes module resolution for that interpreter and can persistently influence future Python executions, yet the script does not clearly disclose this behavior before doing it.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill directs the agent to persist conversation-derived entities, relationships, and feedback into reusable long-term memory without defining limits for sensitive data categories. In a memory system specifically designed for recursive growth and reuse, unrestricted storage can accumulate personal data, confidential project details, or harmful inferences that may later be surfaced or misused.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The instructions explicitly tell the agent to inject memory context returned by `session.start()` into its system prompt, which can cause previously stored user-derived information to influence future sessions invisibly. This raises the risk of cross-session data leakage, over-retention, and unintended resurfacing of private details in contexts where the user did not expect prior data to be reused.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.