Security audit

memory-plus

Security checks across malware telemetry and agentic risk

Overview

This is a real memory workflow, but it asks for always-on memory retrieval and broad persistence controls that users should review before installing.

Install only if you intentionally want cross-chat memory that may be searched on every message. Review and edit the AGENTS.md rule before applying it, avoid saving secrets or sensitive conversations, confirm the installed path is correct, use only trusted Ollama, embedding, and Milvus endpoints, and back up the memory directory before using prune or cleanup tools.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code is designed to send memory content to external embedding and LLM HTTP services, which creates an outbound data exfiltration path for potentially sensitive user content. In a memory-storage component, this is risky because stored notes may contain secrets, personal data, or internal context, and the transfer happens automatically without visible consent or data minimization.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The component connects to a Milvus service on a network address, so persisted memory content may leave the local trust boundary and be exposed to another service. Even if Milvus is expected in the architecture, this is still a security-relevant network dependency because it expands attack surface and may store sensitive content without access-control guarantees shown here.

Vague Triggers

High

Confidence: 92% confidence
Finding: The skill auto-activates on broad everyday phrases like references to memory, prior discussion, searching, deduping, or organizing, which can easily match normal conversation unrelated to explicit consent for persistence operations. In this context, overbroad activation increases the chance that the agent performs memory retrieval or storage unexpectedly, exposing prior data or causing unintended processing of user content.

Vague Triggers

High

Confidence: 96% confidence
Finding: The trigger table uses ambiguous single-character and generic terms such as '记', '存', '搜', and '找', which are extremely common in ordinary Chinese conversation. Because these triggers map directly to storage, search, consolidation, and deletion actions, the skill may execute sensitive data operations without a clear user request or informed intent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The installation instructions direct the agent to automatically search memory on every message and to support full-session saving, but they do not provide a clear user-facing notice about persistent storage, retrieval, or data handling. This is dangerous because users may unknowingly have sensitive content searched against or written into long-term storage without informed consent.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The prune command permanently deletes files based only on filename-derived dates and a user-supplied --days value, with no confirmation prompt, dry-run mode, or safety guardrails. In an agent skill context, this is risky because an unintended invocation, bad parameter, or automation error can cause silent loss of memory data, which is especially dangerous for stateful workflows that rely on retained history.

Missing User Warnings

Medium

Confidence: 75% confidence
Finding: The script writes conversation/session contents to a temporary file on disk before passing them to another component. Session data often contains secrets, prompts, tokens, or user content, so persisting it to disk can expose sensitive information to other local processes, backups, forensic recovery, or accidental retention if deletion fails.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: User-supplied memory content is transmitted over HTTP to external embedding and LLM services without any notice, consent, or sensitivity screening. Because this code handles arbitrary 'memory' text, it could leak credentials, personal data, business information, or conversation history to network services outside the immediate process.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The function persistently writes all provided content into local markdown files without user-facing warning or retention controls. For a memory feature this may be intended, but it still creates a privacy and forensic risk because sensitive content can be stored long-term on disk in a predictable location.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The subprocess inherits the full parent environment via os.environ, which may include secrets such as API keys, tokens, credentials, or proxy settings. If memory_ops.py, its dependencies, error handling, or child processes expose or misuse those variables, sensitive data could be leaked or used unexpectedly across trust boundaries.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The /save behavior explicitly stores the complete current session, including all user and assistant content, into persistent memory. Full-session persistence can capture secrets, personal data, credentials, or sensitive instructions far beyond what the user intended to remember, especially when no filtering, minimization, or confirmation is described.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The storage pipeline records arbitrary content to disk, extracts triples, generates embeddings, and may forward the same content to external services, all without any sensitivity classification or minimization. This makes the component dangerous in context: a memory system is especially likely to receive secrets, personal data, and internal notes, so automatic broad persistence and relay significantly increases confidentiality risk.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.