Security audit

memory-booster

Security checks across malware telemetry and agentic risk

Overview

This memory skill is mostly coherent, but it asks for broad access to past conversations and local memory files, can automatically surface that history, and includes analytics tracking without enough user control.

Install only if you are comfortable with a skill reading and indexing WorkBuddy memory files and historical conversation results. Before use, configure exactly which memory directories it may access, avoid saving secrets or confidential client data, disable or remove the analytics section unless you explicitly want telemetry, and treat automatic warmup/first-reply recall as a privacy risk in shared sessions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill includes analytics/telemetry events for start, step, completion, and error reporting even though the stated purpose is memory enhancement, not telemetry. Collecting usage metadata without a clear necessity, consent flow, retention policy, or destination disclosure increases privacy risk and may expose user or workflow metadata beyond the core function.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The script sets a third-party HuggingFace mirror endpoint globally and later loads a transformer model, which can trigger outbound network access and remote artifact retrieval during indexing. For a local memory-indexing tool, this introduces an undisclosed supply-chain and privacy risk because model downloads may depend on an external service the user did not explicitly approve.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: Forcing `HF_ENDPOINT` to `https://hf-mirror.com` redirects model resolution to a third-party service for all HuggingFace interactions in this process. This expands trust to an external mirror and can expose metadata or retrieve tampered/unexpected model files, which is risky for a tool whose stated function is local semantic indexing.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: Using broad natural-language triggers like '你还记得...吗' or similar everyday phrasing for memory recall can cause unintentional activation of retrieval logic. In this skill, that matters because retrieval may search historical conversations and local memory files, increasing the chance of surfacing sensitive prior content without clear user intent for a full recall operation.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: Automatically invoking memory warmup at every conversation start is overly broad because it triggers local file reads and history retrieval without a fresh, contextual need-to-know check. This can unnecessarily expose prior sensitive data in sessions where memory is not relevant, especially since the skill later requires the first reply to include recalled content.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill is designed to collect, persist, search, and surface broad conversation and memory data, yet the description lacks a clear privacy warning about retention, local scanning, and retrieval of historical conversations. Users may therefore disclose sensitive personal or business information without understanding that it may be stored and resurfaced later.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The forge workflow writes generated files after user confirmation, but it does not clearly warn that this modifies the local filesystem and may create installable modules for later execution. Users may interpret '确认' as approving content generation only, not file creation in a specific path.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The archive feature explicitly deletes diary files after moving or summarizing them, but the documentation lacks a prominent deletion warning and rollback guidance. Deletion of user-authored historical records is a destructive operation that can cause data loss, especially if the archive or extraction step is incomplete or incorrect.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The telemetry section describes event collection but does not present a user-facing privacy warning, consent mechanism, or disclosure of recipients and retention. Even if payloads look operational, they can reveal usage patterns, workflow timings, and identifiers that exceed the expectations of a local memory tool.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script silently overrides the Hugging Face endpoint to https://hf-mirror.com for all downstream library calls in this process. In a memory-management skill that may process sensitive conversation history, redirecting model or embedding downloads to an unofficial mirror without explicit disclosure creates supply-chain, privacy, and integrity risk.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: Loading `SentenceTransformer("all-MiniLM-L6-v2")` may download model files if they are not already present, causing network access without any explicit disclosure or confirmation. In a memory tool that may process sensitive local notes, silent remote dependency fetching is a meaningful transparency and operational security issue.

Ssd 3

High

Confidence: 98% confidence
Finding: The skill instructs the agent to surface recalled memory in the first reply automatically, before validating whether the current context warrants revealing prior conversation or diary content. This can expose sensitive personal, business, or file-location information to anyone viewing the current session, even if the user did not explicitly request detailed recall at that moment.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The skill persistently stores broad categories of conversation-derived information including decisions, issues, next steps, links, and file locations, then later retrieves them through search interfaces. This creates a durable natural-language data store that can accumulate sensitive operational context and make later overexposure more likely.

Ssd 3

Medium

Confidence: 88% confidence
Finding: The auto-reminder logic nudges users to persist conversation state at decision points and session end, increasing collection and retention of information that may not need to be stored. While not covert exfiltration, this design encourages excessive accumulation of potentially sensitive data over time.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.