Security audit

Engram — Knowledge Graphs for AI Agents

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent local knowledge-graph tool, but it encourages persistent storage of sensitive operational and personal relationship details without clear guardrails.

Review before installing. Use this only for intentionally scoped, non-sensitive architecture or dependency facts. Do not store secrets, credential locations, SSH configuration details, trust assessments, private channels, or personal profiles unless there is explicit need and consent. Consider setting a dedicated ENGRAM_DB_PATH, reviewing the database contents, and deleting models that are no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The documentation explicitly encourages storing sensitive local operational data such as SSH configs, credential paths, and trust levels in a persistent knowledge graph. Even if the database is local, this broadens the tool from architecture mapping into retention of security-sensitive and privacy-sensitive data, increasing the chance of inadvertent disclosure, overcollection, and misuse by future sessions or other local processes.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger phrase 'any request to track relationships between entities' is so broad that it can activate the skill in many unrelated contexts. That increases the chance the agent will invoke persistent graph storage for data the user did not intend to retain, including sensitive relationship, organizational, or system information.

Missing User Warnings

High

Confidence: 94% confidence
Finding: The skill markets persistent storage of nodes covering people, services, and concepts without any immediate warning about privacy, retention, or handling of sensitive data. In context, this can normalize storing personal or operationally sensitive information across sessions without informed consent or guardrails.

Missing User Warnings

High

Confidence: 97% confidence
Finding: This section specifically recommends modeling infrastructure details, people, channels, trust levels, and credential-related paths, which are highly sensitive categories, while providing no safety boundaries. The combination of persistence and agent reuse makes this more dangerous because future sessions can access and expand a long-lived profile and operational map.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The instructions encourage building a persistent cross-session store of sensitive personal and operational information. Persistent retention amplifies harm because data may outlive the immediate task, be reused in new contexts, and create a durable local dossier of people, infrastructure, and security-relevant details.

Ssd 3

Medium

Confidence: 95% confidence
Finding: Storing roles, trust levels, and organizational relationships creates a persistent profiling system for individuals. This is dangerous because it can support surveillance, social engineering, biased decision-making, and privacy violations, especially when retained across sessions and combined with other operational context.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.