Security audit

Veritas Memory

Security checks across malware telemetry and agentic risk

Overview

This memory skill is openly about persistent memory, but it also normalizes broad transcript searches, credential retention, and service changes that require careful review.

Install only if you intentionally want an agent to maintain persistent memory and credential location indexes. Before using it, restrict transcript and credential searches to named scopes, require explicit approval before storing secrets or modifying server configuration, prefer a secrets manager over files/systemd text, and review any STATE.md/MEMORY.md deletion or service restart before it happens. VirusTotal and the static scan were clean, so the Review verdict is based on the artifact instructions themselves, not malware telemetry.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Context-Inappropriate Capability

High

Confidence: 93% confidence
Finding: The skill expands from memory management into deployment and service administration, including restarting services and validating production changes. That scope escalation is dangerous because a memory skill should not authorize operational changes on hosts; if followed, it could cause unauthorized modifications, outages, or be abused as a path to production control.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill instructs the agent to write received credentials into CREDENTIALS_INDEX.md, server .env files, and systemd Environment entries as a normal workflow. This is highly dangerous because it normalizes credential persistence and redistribution across multiple storage locations, increasing exposure, privilege escalation risk, and the blast radius of any host or repo compromise.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The guidance directs broad credential discovery across .env files, systemd definitions, /etc/environment, and process environments. This exceeds the legitimate needs of a memory helper and creates a credential-harvesting pattern that can expose unrelated secrets present on the host, including those belonging to other services or users.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Direct filesystem grep over raw session transcript files enables bulk access to historical conversations outside the normal bounded API surface. That is dangerous because transcripts may contain sensitive user data, credentials, or unrelated context, and the fallback encourages broad search and extraction by the agent or sub-agents.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill tells the agent to immediately store credentials in local indexes and server configuration without any warning, consent flow, or data-handling safeguard. This is dangerous because users may provide secrets for one-time use, while the skill silently transforms them into persistent multi-location storage, greatly increasing the chance of accidental disclosure and misuse.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill directs inspection of environment files and process environments for secrets without informing the user that sensitive system data may be accessed. That lack of transparency and approval is dangerous because it can cause the agent to traverse privileged data sources and expose secrets beyond the immediate task context.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill explicitly instructs archival and deletion of memory artifacts ('MEMORY.md items >90 days unconfirmed → archive', 'Daily notes >30 days → mark archivable', 'Completed todos → delete') without requiring explicit user confirmation, retention policy checks, or a reversible workflow. In a memory-management skill, these actions can silently remove historical context, degrade auditability, and cause loss of information that later decisions may depend on.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The document explicitly instructs the agent to 'Fix STATE.md' as part of its normal correction flow, but it does not require user confirmation, change visibility, or any safety boundary before altering persistent state. In a memory-management skill, silent state mutation is especially risky because incorrect log interpretation, prompt injection, or simple mistakes can permanently overwrite cached memory and influence later decisions.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: This prompt instructs the agent to modify local state files and explicitly delete stale information, but it provides no requirement for user consent, preview, confirmation, or safety checks before writing. In a memory-management skill that derives updates from conversation history, this creates a real risk of unauthorized or incorrect persistence, deletion, or corruption of operational memory based on incomplete or manipulated transcript content.

Ssd 3

High

Confidence: 99% confidence
Finding: The instructions normalize persistent collection and reuse of user-provided credentials from chats, indexes, encrypted files, and server environments as part of standard operation. This is dangerous because it creates a durable secret-retention system with multiple retrieval paths, increasing unauthorized reuse, exfiltration, and cross-task disclosure risks.

Ssd 3

High

Confidence: 94% confidence
Finding: Treating prior conversations as authoritative memory and requiring startup/recovery reads of transcripts enables broad reuse of sensitive information previously shared by the user. In this skill's context, that is especially dangerous because the same document also encourages harvesting and indexing credentials, making transcript reprocessing a mechanism for repeated secret collection.

Ssd 3

High

Confidence: 97% confidence
Finding: The deep-history workflow tells the agent or sub-agents to search all session transcript files for matching user messages, effectively enabling broad semantic mining of historical user content. This is dangerous because it bypasses minimization principles and can surface unrelated sensitive information, including credentials and private conversations, at scale.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.