T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:413- Finding
Google Data Access Without Explicit Per-Service Consent
- Content
View full analysis
- Remediation
View remediation
Security audit
Memi
Security checks for vulnerabilities and agentic risk
Overview
This skill is not clearly malicious, but it needs review because it persistently builds a detailed relationship database and can use existing Google credentials to mine Gmail, Calendar, and Contacts without clear opt-in controls.
Review this carefully before installing. It is designed to remember and infer a lot about your relationships over time, including notes about other people, commitments, preferences, meeting context, email-derived signals, and your own communication patterns. If you use gog, make sure you are comfortable with the skill reading recent Gmail, Calendar, and Contacts data and storing derived information locally. Prefer installing only if you can control or audit the database, disable Google ingestion when unwanted, and delete the stored data when needed.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:67- Finding
Unprotected Plaintext Storage of Sensitive Relationship Data
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill is designed to remember everyone the user meets, track promises, and continuously improve from ongoing use, which implies broad persistent collection of personal and relational data. This creates significant surveillance and retention risk for both the user and third parties, especially when the collection is framed as ambient and always-on.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs persistent storage of extensive relationship data in a local SQLite database but provides no user-facing warning or consent flow about retention. Users may unknowingly create a long-lived repository of sensitive information about themselves and third parties, increasing privacy, legal, and breach exposure.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The schema stores a very broad set of sensitive data: contacts, preferences, dates, commitments, interaction history, inferred signals, relationship graphs, and a behavioral profile of the user. Centralizing this volume of structured personal data substantially raises the consequences of misuse, unintended disclosure, or unauthorized local access.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs continuous construction of a persistent model of the user, including communication style, priorities, rhythms, patterns, and life context. This kind of behavioral profiling is especially sensitive because it goes beyond factual storage into inference about the user’s habits and social behavior.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Requiring logging of every contact reference and every interaction ensures comprehensive capture of user conversational metadata and content over time. This is dangerous because it turns casual mentions into durable records, enabling extensive retrospective analysis without granular consent or minimization.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill directs access to Gmail, calendar, and contacts data without corresponding user-facing disclosure about the sensitivity of those sources or the extent of derived data collection. Because these integrations can reveal meetings, contacts, and email content, undisclosed access materially increases privacy risk and user surprise.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The Google integration section authorizes scanning emails for signals like promotions, moves, commitments, and introductions, then storing and cross-referencing them. This compounds privacy risk by combining direct message content with inferred relationship intelligence, potentially capturing sensitive third-party information without their knowledge.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill description is broad and does not define clear invocation boundaries for when proactive extraction, tracking, or analysis should occur. In practice, this can cause the agent to collect and persist sensitive relationship data from ordinary conversation without sufficiently specific user intent.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ## Personality **Mirror the user's style.** Match their formality, capitalization, punctuation, emoji usage, and verbosity. If they text in lowercase with no punctuation, you do too. If they write formally, match that. **Default tone** (before you've learned their style): Standard case, light punctuation, no emoji, 1-2 sentences, em dashes where natural.
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill’s stated purpose is a personal CRM, but it expands into automated ingestion of Gmail and calendar data to derive relationship intelligence. That broadens data collection into highly sensitive external sources without clear user-scoped limits, creating a material privacy and overcollection risk beyond what a user may reasonably expect from a contact-saving skill.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation explicitly authorizes scanning recent Gmail messages for life events, introductions, and commitments, then storing those derived signals. Email content is highly sensitive, and mining it for secondary inferences can expose private third-party data and user behavioral data far beyond minimally necessary CRM functionality.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The instruction to skip unavailable Google features silently normalizes invisible behavior around external integrations and reduces transparency about when such data sources are or are not in use. That same opacity can make it harder for users to understand, audit, or challenge privacy-sensitive access patterns.
- Content