Memory System Pro V2

• Outcome: Review
• Latest audit: May 29, 2026 · 9:30 PM UTC
• Version: 2.0.1

Overview

This is a real memory-management skill, but it gives the agent broad file access and automatic memory-editing powers that need careful review before installation.

Install only if you are comfortable with a persistent memory system that stores conversation-derived data locally, auto-loads it into later sessions, may send memory contents to MiniMax, and can automatically edit or delete memory files. Before use, disable AutoDream/heartbeat if possible, restrict memoryDir to a dedicated non-sensitive folder, avoid storing secrets or sensitive personal data, and require manual review or backups for deletions and overwrites.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (38)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises substantial capabilities that imply access to environment variables, local shell execution, and networked/local services, but does not declare permissions or present user-facing trust boundaries. This is dangerous because a memory skill handling sensitive personal and session data can silently expand into code execution and external data processing without informed consent or sandbox review.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented behavior understates the real operational scope: automatic loading, heartbeat-triggered actions, persistence/flush logic, local embedding service access, and subprocess invocation materially change the security posture. Users may consent to a simple memory feature while unknowingly enabling background scanning, file modification, and command execution pathways.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code directly applies LLM-generated instructions to create files, delete files, and overwrite the memory index without validation or human approval. Because model output is untrusted, a prompt-injected or hallucinated response can destroy data or create attacker-chosen content inside the user's memory store.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: LLM-supplied paths are joined with the memory directory and used for file creation and deletion without canonicalization or boundary checks. An attacker can return paths like '../.ssh/authorized_keys' or absolute paths to escape the intended directory and overwrite or delete arbitrary files accessible to the process.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This embedding helper invokes shell commands through child_process for both service checks and inference calls, which gives the component unnecessary command-execution capability. In this file, that risk becomes concrete because embedText later interpolates attacker-controlled text into a shell-built curl command, creating a command-injection path rather than merely an architectural smell.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The path expansion logic allows absolute paths and parent-relative traversal because non-absolute paths are simply joined to the configured memory directory and absolute paths are accepted as-is. In a memory-system skill, this breaks the expected storage boundary and can let callers read arbitrary files on the host, including secrets, configs, and SSH keys, if the caller controls filePath.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The path handling allows caller-controlled absolute paths and relative traversal outside the configured memory directory. Because the function creates parent directories and writes file content, a caller can use this broader-than-advertised capability to overwrite or create arbitrary files accessible to the process, which is a significant boundary-break for a memory-writing skill.

Intent-Code Divergence

Low

• Confidence: 91% confidence
• Finding: The code performs memory type validation but only returns a warning string and continues writing regardless of invalid input. This creates a false sense of enforcement and can let callers bypass expected data classification or routing controls, which may weaken downstream security assumptions or policy checks.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The documented manual trigger phrase appears to be a simple natural-language command without authentication, confirmation, or scope constraints. In a memory-management skill that can modify stored data, overly broad triggering increases the risk of accidental or prompt-injected invocation of consolidation behavior.

Missing User Warnings

High

• Confidence: 94% confidence
• Finding: The changelog describes silent automatic memory consolidation that runs on a schedule and 'does not disturb' the user when changes occur. In a system that stores and rewrites memories, silent background execution reduces user visibility and consent, making unintended data mutation or attacker-influenced consolidation harder to detect.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The file documents automatic addition, deletion, and updating of memory files based on LLM output, but gives no indication of guardrails around destructive changes. Letting model output directly drive file mutations can corrupt memory state, delete valuable records, or be abused through prompt manipulation if upstream inputs influence the LLM.

Missing User Warnings

High

• Confidence: 92% confidence
• Finding: Automatic scanning, cleanup, and update of memory implies broad read/write access over user data with no documented safeguards, warnings, or rollback mechanism. In the context of a persistent memory skill, this increases the blast radius of logic errors, unsafe prompts, or maliciously induced consolidation decisions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation explicitly describes scheduled memory scanning, LLM-driven analysis, deletion of stored memories, and automatic index updates, but it does not disclose consent, review, backup, or privacy controls. In a memory system handling conversation history and user data, silent automated modification of persisted data creates a real risk of unintended retention, exposure to third-party model providers, and irreversible deletion.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The HEARTBEAT section says the feature is automatically configured, runs daily at 22:00, and executes silently unless changes are notable. Background processing of stored conversation history without prominent notice or explicit consent is dangerous because users may not realize their retained data is being revisited, analyzed, or altered on a schedule.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README explicitly advertises private/team memory storage, automatic loading, and automatic saving, but it does not warn that sensitive user, team, or project data may be persisted to disk and later resurfaced. In a memory system skill, this omission is security-relevant because users may store credentials, personal data, internal decisions, or other confidential material under the assumption that the feature is ephemeral or low-risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: AutoDream is described as automatically adding, deleting, and updating memory after scanning memory files and session history, but the skill does not provide a prominent warning about destructive modification of persisted data. For a memory system, undisclosed automated deletion or rewriting can cause privacy issues, data loss, and integrity problems that users do not expect.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The write and flush tools persist conversation-derived data to local storage, but the descriptions do not clearly warn users that information will be stored beyond the current session. This creates a transparency and privacy problem, especially when the stored content may include sensitive user preferences, feedback, or project details.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The manifest explicitly says to save user memory when learning 'any personal details,' which is an unbounded retention rule for potentially sensitive personal data. In a persistent memory skill with automatic loading and scheduled consolidation, this creates a real privacy and data-minimization risk because routine conversation details may be stored indefinitely without clear consent, filtering, or sensitivity exclusions.

Vague Triggers

Low

• Confidence: 72% confidence
• Finding: The project-memory rule says to save information whenever the system 'understands project dynamics,' but does not define ownership, confidentiality boundaries, or necessity thresholds. In a team-scoped persistent memory system, this can lead to over-collection of internal project details and accidental retention of confidential business context.

Vague Triggers

Low

• Confidence: 69% confidence
• Finding: The reference-memory trigger allows saving data whenever external resources are learned about, which is vague enough to capture incidental links, system endpoints, or environment-specific pointers. While lower impact than personal data capture, it can still accumulate internal URLs, repository references, or infrastructure metadata that should not be broadly retained.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill declares automatic memory loading on session start and scheduled consolidation on heartbeat, including deletion and merging of memory, but does not present a clear user warning or consent mechanism for persistent storage and automated modification. This is dangerous because users may unknowingly have their data retained, transformed, or removed by background processes driven by an LLM.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The memory_write tool provides direct file-writing capability into the configured memory directory without a clear warning about persistence or file modification semantics. In a memory skill, silent writes increase the chance of storing sensitive user or project data without informed consent and make it harder for users to understand where their information is going.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The function builds a prompt from memory index content and memory files, then sends that material to an external LLM service. Since this memory system explicitly stores private user preferences, feedback, and project data, transmitting it off-device without explicit disclosure or consent creates a serious confidentiality risk.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The code deletes files based solely on parsed LLM output, with no confirmation step, safety review, or recovery mechanism. Because the model can be manipulated by malicious file contents or simply make mistakes, this can lead to irreversible loss of user memory data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill writes new files and overwrites MEMORY.md from LLM output without clearly warning the user that their stored data will be modified. Even when limited to the memory directory, unreviewed writes can corrupt indexes, introduce false memories, or degrade trust in the stored knowledge base.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/autoDream.ts:82