Security audit

Wb Lobster Memory

Security checks across malware telemetry and agentic risk

Overview

This long-term memory skill is purpose-aligned, but it can automatically persist and later modify conversation-derived personal or project information without clear user consent controls.

Review before installing. Use this only if you are comfortable with the agent saving conversation-derived preferences, relationships, emotional signals, project context, and feedback into a durable local graph. Configure the storage directory deliberately, trust the separate lobster-memory install before running it, require explicit confirmation before writes, and run consolidation in dry-run mode with backups before allowing changes.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares environment-variable requirements and directs execution of a Python runner and external engine, but there is no explicit permissions model documenting access to environment-derived paths or persistent storage. This creates a transparency and governance gap: operators may not realize the skill can read configuration from env vars and write long-term memory data to local disk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README explicitly describes persistent memory writes, recall, and forgetting/consolidation, but does not clearly warn users that conversation-derived data may be stored long-term or that consolidation/forgetting can modify or remove stored information. In a memory skill handling user preferences, relationships, and feedback, this creates real privacy and integrity risk because operators may enable it without informed consent or safeguards.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The condition “对话出现值得长期保留的偏好/关系/反馈时触发” delegates activation to subjective agent judgment rather than explicit user consent. In a memory skill, this materially increases the risk of over-collection and silent persistence of personal conversational details into durable storage.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The phrase “回忆一下” lacks an object or scope, so the skill may activate without clear user intent about what memory should be retrieved. Because the skill handles long-term personal and project context, ambiguous recall requests can expose unrelated or sensitive stored information.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The condition “对话出现值得长期保留的偏好/关系/反馈时触发” delegates activation to subjective agent judgment rather than explicit user consent. In a memory skill, this materially increases the risk of over-collection and silent persistence of personal conversational details into durable storage.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill description says it stores user preferences, project context, and feedback in long-term graph memory, but it does not provide a clear privacy notice, retention policy, or consent model. This is dangerous because users may reveal sensitive personal or workplace information without understanding that it will be durably stored and later recalled.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The consolidate command can mutate long-term memory state by merging nodes and soft-deleting data automatically once should_consolidate() returns true, without any explicit confirmation, audit prompt, or safeguard at the bridge layer. In a memory-management skill, this is security-relevant because it can silently alter or discard user data integrity based on a trigger or round count, making accidental or unauthorized destructive maintenance harder for users to detect or prevent.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The instructions tell the agent to extract and persist information whenever user content is deemed informative, not only when the user explicitly asks to be remembered. This default-to-storage behavior can capture sensitive preferences, relationships, emotional states, and feedback from ordinary conversation, creating privacy and secondary-use risks.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The trigger semantics broadly encourage remembering valuable user information beyond explicit memory requests, normalizing passive surveillance of conversation for future storage. Given the skill’s purpose of building long-term relationship and feedback graphs, this significantly raises the likelihood of collecting more personal data than the user expects.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.