Enhanced Memory System V2

• Analyzed: Mar 31, 2026, 11:41 AM
• Findings: 1
• Version: 1.2.0
• Hash: d744ab7f5a491810846d1ea59a2e74ec21418bbd5af53cdd4d7536904565f7be
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle implements a functional memory system but contains critical security vulnerabilities that could be exploited. Specifically, the `memory_get` and `memory_write` tools in `src/get.ts` and `src/write.ts` are vulnerable to Path Traversal, as they allow absolute paths or parent directory references (e.g., '../../') to access files outside the intended memory directory. Additionally, `src/embed.ts` uses `child_process.exec` to execute a `curl` command with parameters derived from user-controlled text, creating a risk of Shell Injection. While these represent significant RCE and data access risks, they appear to be unintentional design flaws rather than deliberate malicious logic.