Memi

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:05 AM UTC
• Version: 1.1.0

Overview

This skill is not clearly malicious, but it needs review because it persistently builds a detailed relationship database and can use existing Google credentials to mine Gmail, Calendar, and Contacts without clear opt-in controls.

Review this carefully before installing. It is designed to remember and infer a lot about your relationships over time, including notes about other people, commitments, preferences, meeting context, email-derived signals, and your own communication patterns. If you use gog, make sure you are comfortable with the skill reading recent Gmail, Calendar, and Contacts data and storing derived information locally. Prefer installing only if you can control or audit the database, disable Google ingestion when unwanted, and delete the stored data when needed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:413
• Finding: Google Data Access Without Explicit Per-Service Consent<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:413-417` **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ### Vulnerable Code ```markdown - **Gmail**: `gog gmail search 'newer_than:7d' --max 20` — scan recent emails for relationship signals. Extract life events ("just got promoted", "moving to Austin"), commitments mentioned in email, new introductions, and topic signals. Store in the `signals` table and cross-reference with contacts. - **Contacts**: `gog contacts list --max 100` — enrich existing contacts with missing phone, email, birthday data from Google Contacts. Fill blanks only, never overwrite. - **Sending**: `gog gmail send` / `gog gmail drafts create` — when the user asks to draft or send a follow-up email, use gog. Match the user's communication style for that contact. Don't require gog. If it's not installed, skip Google features silently — everything else works without it. ``` ### Technical Analysis The skill instructs the agent to use pre-existing `gog` OAuth authorization to search recent Gmail messages and enumerate Google Contacts. It does not require explicit, service-specific consent before accessing those sources. The silent feature-detection behavior also means the user may not receive a clear indication that credential-backed data access occurred. Existing authorization for a local tool does not necessarily establish consent for every installed skill to process all data available through that tool. Gmail messages can contain private correspondence and information about unrelated third parties, while Google Contacts can expose names, email addresses, phone numbers, and birthdays. The documented email-sending capability is conditioned on a user request and is therefore not independently classified as unauthorized sending. The primary issue is the broadly instructed background scanning and enrichment behavior. ### Attack Path 1. The user has installed and authenticated ...[truncated 1313 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit opt-in before accessing each Google service: Gmail, Calendar, and Contacts. 2. Display the exact data source, query, time range, and intended use before the first access. 3. Store consent state separately for each service and allow the user to revoke it. 4. Do not infer authorization merely from the presence of `gog` or existing OAuth credentials. 5. Replace silent activation with a clear notice when an optional integration is available. 6. Default to metadata-only access and retrieve message bodies only when necessary. 7. Reduce query ranges and result limits to the minimum needed for the immediate request. 8. Require confirmation before persisting extracted third-party information. 9. Prevent Google-derived content from entering external LLM context unless the user has explicitly consented to that processing. 10. Maintain an access log showing which integration was queried, when it was queried, and what categories of data were stored. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:67
• Finding: Unprotected Plaintext Storage of Sensitive Relationship Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:67-108` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Vulnerable Code ```markdown Store everything in a SQLite database at `~/.local/share/memi-ri/memi.db`. Create the database and all tables on first use if they don't exist. ### Tables **contacts** — Core contact records. Columns: `id` (integer primary key), `name` (text, required), `email`, `phone`, `company`, `role_title`, `how_met` (WHERE/WHAT context, never just "met"), `location`, `notes`, `interests` (comma-separated), `photo_path`, `relationship_score` (real, default 0), `relationship_status` (text: new/thriving/warming/stable/cooling/cold/lost, default 'new'), `mention_count` (integer, default 0), `last_mention_at` (ISO 8601), `score_updated_at`, `archived_at`, `created_at`, `updated_at`. **contact_notes** — Structured notes with tags. Columns: `id`, `contact_id` (foreign key), `content` (text), `tags` (comma-separated), `created_at`. **contact_preferences** — Likes, dislikes, dietary info, gift ideas. Columns: `id`, `contact_id`, `pref_type` (likes/dislikes/allergies/dietary/gift_ideas), `pref_value` (text), `created_at`. **commitments** — Promises the user has made to people. Columns: `id`, `contact_id`, `promise_text`, `status` (pending/completed/expired/cancelled, default 'pending'), `priority` (low/medium/high, default 'medium'), `due_date` (ISO 8601), `context` (original message), `created_at`, `updated_at`. **interactions** — Log of all contact touchpoints. Columns: `id`, `contact_id`, `interaction_type` (message/meeting/email/phone_call/note), `content`, `sentiment` (positive/neutral/negative), `created_at`. **signals** — Extracted intelligence from any source (email, conversations, calendar). Columns: `id`, `contact_id` (nullable), `signal_type` (life_event/commitment/topic/introduction), `content`, `source` (text — where this signal came from, e.g. "email from [e-mail]", ...[truncated 3064 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create `~/.local/share/memi-ri` with permissions limited to the owning user, such as mode `0700`. 2. Create the database with mode `0600` and verify permissions after creation. 3. Support encryption at rest using an appropriate encrypted SQLite implementation or application-level field encryption. 4. Store encryption keys in the operating system's secure credential store rather than beside the database. 5. Replace “store everything” with explicit data-minimization rules. 6. Require consent before retaining email-derived content or information about third parties. 7. Define configurable retention periods for interactions, signals, and inferred behavioral observations. 8. Provide export, selective deletion, and complete deletion controls. 9. Ensure soft-archived records can be permanently erased when the user requests deletion. 10. Avoid storing full message content when a minimal structured summary is sufficient. 11. Document backup and synchronization risks so users can exclude the database from insecure cloud backups. 12. Consider field-level protection for especially sensitive values such as phone numbers, private notes, allergies, and email-derived life events. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Ssd 3

High

• Confidence: 98% confidence
• Finding: The skill is designed to remember everyone the user meets, track promises, and continuously improve from ongoing use, which implies broad persistent collection of personal and relational data. This creates significant surveillance and retention risk for both the user and third parties, especially when the collection is framed as ambient and always-on.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill instructs persistent storage of extensive relationship data in a local SQLite database but provides no user-facing warning or consent flow about retention. Users may unknowingly create a long-lived repository of sensitive information about themselves and third parties, increasing privacy, legal, and breach exposure.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The schema stores a very broad set of sensitive data: contacts, preferences, dates, commitments, interaction history, inferred signals, relationship graphs, and a behavioral profile of the user. Centralizing this volume of structured personal data substantially raises the consequences of misuse, unintended disclosure, or unauthorized local access.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The skill instructs continuous construction of a persistent model of the user, including communication style, priorities, rhythms, patterns, and life context. This kind of behavioral profiling is especially sensitive because it goes beyond factual storage into inference about the user’s habits and social behavior.

Ssd 3

High

• Confidence: 97% confidence
• Finding: Requiring logging of every contact reference and every interaction ensures comprehensive capture of user conversational metadata and content over time. This is dangerous because it turns casual mentions into durable records, enabling extensive retrospective analysis without granular consent or minimization.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill directs access to Gmail, calendar, and contacts data without corresponding user-facing disclosure about the sensitivity of those sources or the extent of derived data collection. Because these integrations can reveal meetings, contacts, and email content, undisclosed access materially increases privacy risk and user surprise.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The Google integration section authorizes scanning emails for signals like promotions, moves, commitments, and introductions, then storing and cross-referencing them. This compounds privacy risk by combining direct message content with inferred relationship intelligence, potentially capturing sensitive third-party information without their knowledge.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The skill description is broad and does not define clear invocation boundaries for when proactive extraction, tracking, or analysis should occur. In practice, this can cause the agent to collect and persist sensitive relationship data from ordinary conversation without sufficiently specific user intent.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Personality

**Mirror the user's style.** Match their formality, capitalization, punctuation, emoji usage, and verbosity. If they text in lowercase with no punctuation, you do too. If they write formally, match that.

**Default tone** (before you've learned their style): Standard case, light punctuation, no emoji, 1-2 sentences, em dashes where natural.

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill’s stated purpose is a personal CRM, but it expands into automated ingestion of Gmail and calendar data to derive relationship intelligence. That broadens data collection into highly sensitive external sources without clear user-scoped limits, creating a material privacy and overcollection risk beyond what a user may reasonably expect from a contact-saving skill.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly authorizes scanning recent Gmail messages for life events, introductions, and commitments, then storing those derived signals. Email content is highly sensitive, and mining it for secondary inferences can expose private third-party data and user behavioral data far beyond minimally necessary CRM functionality.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The instruction to skip unavailable Google features silently normalizes invisible behavior around external integrations and reduces transparency about when such data sources are or are not in use. That same opacity can make it harder for users to understand, audit, or challenge privacy-sensitive access patterns.

Static analysis

No suspicious patterns detected.