Enhanced Memory System with 4 Types

• Analyzed: Mar 31, 2026, 11:46 AM
• Findings: 1
• Version: 1.1.0
• Hash: dbeae1ac1d89ce40ca16bbe50164d62fce9f92f1fba84749746f171f482f97c0
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill implements a memory management system using local Markdown files and Ollama embeddings, but it contains significant security vulnerabilities. Specifically, `src/embed.ts` uses `child_process.exec` to execute a `curl` command against a local Ollama instance (`http://localhost:11434`) with user-provided text that is inadequately sanitized (only double quotes are escaped), leading to a shell injection risk. Additionally, the file operations in `src/get.ts` and `src/write.ts` lack path validation, potentially allowing path traversal attacks via the `path` parameter. While these appear to be unintentional flaws rather than intentional malice, they pose a high risk to the host environment.