Security audit

Agent Memory Journal

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local memory journal for agents; it persists notes and can affect future agent context, but the behavior is purpose-aligned and no hidden network, credential, or destructive activity was found.

Install this only if you want an agent to keep durable local memory. Treat .memory as potentially sensitive, review .memory/config.json before enabling hot_path overrides, and avoid logging secrets or regulated personal data because session and episodic files persist until you delete or manage them.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README explicitly states that session memory is stored as persistent files and notes that cleanup is only a future feature, but it does not warn users about retention, access controls, or avoiding secrets and personal data. For an agent memory system, session logs can easily accumulate sensitive operational context, credentials, or user data, so documenting persistence without safeguards increases the risk of unintended long-term exposure.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: This API exposes persistent memory creation, update/supersession, and deletion-like behavior without any built-in user notification, consent check, or audit/authorization guard at the interface layer. In an agent skill context, that can let the agent silently store or remove user-related data, creating privacy, integrity, and transparency risks even if the implementation is otherwise functional.

Missing User Warnings

Low

Confidence: 87% confidence
Finding: The note() method persists arbitrary caller-provided text to disk in a predictable local journal file without any indication of consent, notice, redaction, or sensitivity filtering. In an agent context, this can cause unintended storage of secrets, personal data, or sensitive prompts/tool outputs, creating privacy and data-retention risk even though it is not directly enabling code execution or privilege escalation.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The function automatically promotes repeated episodic entries into core memory by calling append_core_memory(..., source='auto') once simple thresholds are met, with no visible user notification, review, or confirmation in this code path. That creates a privacy and integrity risk: untrusted or accidental content can become persistent memory, enabling memory poisoning, retention of sensitive data, or long-term behavioral steering of the agent.

Static analysis

No suspicious patterns detected.