Security audit

SolCore Memory System

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real memory plugin, but it can persist and reuse raw conversations and behavioral data through an external webhook without clear consent, deletion, retention, or redaction controls.

Install only if you intentionally want persistent conversational and behavioral memory. Run the webhook and database only in an environment you trust, set real per-user identifiers, avoid storing secrets or regulated data, and look for documented controls for opt-in, redaction, review, deletion, and retention before using it with sensitive work.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill performs outbound HTTP POST requests to a configurable webhook URL, but there is no manifest-scoped justification, allowlist, or validation of the destination. Even though the apparent purpose is memory integration, configurable network egress creates a data exfiltration path and broadens the trust boundary beyond the host application.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README explicitly instructs agents to persist interactions that include decisions, emotions, performance outcomes, and behavioral patterns, but it provides no user-facing notice, consent model, retention period, deletion mechanism, or data-minimization guidance. Because this skill is specifically designed to build long-term behavioral memory, the omission creates a real privacy and compliance risk rather than a purely theoretical concern.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly states that it automatically stores every interaction, which creates clear privacy and data-retention risk if users are not warned about what data is collected, how long it is kept, and whether sensitive content may be persisted. In the context of a memory system, this is more dangerous than a normal logging feature because the stated purpose is persistent, broad capture of conversational content and metadata over time.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The tool sends the user's query to the SolCore webhook and returns remotely supplied context, but the code provides no explicit disclosure or consent flow about transmitting user data off-tool for retrieval. In a memory plugin, this is especially sensitive because queries may contain private prompts, secrets, or business data that users do not expect to leave the local agent context.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The skill transmits both user input and assistant output to a persistent memory webhook for storage, with no notice, retention controls, or confirmation from the user. This is more dangerous than context retrieval because it creates durable storage of potentially sensitive conversations, credentials, personal data, or regulated content, and the default user_id of 'michael' suggests weak identity hygiene that could also cause cross-user data mixing.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The manifest explicitly describes a persistent memory system and exposes tools to store interactions and retrieve contextual memories, but it provides no activation boundary, consent gate, or policy constraint on when collection should occur. In an agent environment, that creates a real risk of broad default logging of user content and assistant responses, including sensitive data, beyond user expectations.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The tool schema shows persistent storage of raw user input and assistant output, yet the manifest contains no user-facing notice about privacy, retention duration, deletion, or handling of sensitive content. This is dangerous because the skill is specifically designed to accumulate conversational data over time, which can expose secrets, personal data, or regulated information if collected without informed consent and governance.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The agent guidance says to call solcore_store_memory with full user input and full model output, which naturally captures secrets, personal data, credentials, regulated information, and other sensitive free-form text in persistent storage. In a memory system focused on reflective recall, this increases the chance of future unintended disclosure, over-retention, prompt-context leakage, or secondary misuse of sensitive conversational data.

Static analysis

No suspicious patterns detected.