Vanar Neutron Memory

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 4:31 AM UTC
• Version: 1.3.2

Overview

This skill is a disclosed hosted memory integration that sends saved text, search queries, and optionally conversation turns to Vanar Neutron when the user enables those features.

Install only if you want a hosted memory service. Keep auto-capture and auto-recall off unless you are comfortable sending prompts, responses, and saved notes to Vanar Neutron over HTTPS, and avoid storing secrets, regulated data, or confidential business material unless that remote retention is acceptable. Prefer an environment variable or a tightly permissioned credentials file for the API key.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises and relies on shell script execution (`./scripts/neutron-memory.sh` and hook scripts) but does not declare any corresponding permissions or execution capabilities in a structured way beyond metadata. This creates a transparency and governance gap: users or platforms may underestimate that the skill can execute local shell code and perform networked data transfer, increasing the risk of unexpected command execution or data exfiltration if the scripts are invoked.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: When enabled, this hook packages the full user message and assistant response and sends them to a remote API endpoint. For a memory skill this may be functionally related, but capturing entire conversations by default within a hook creates a real privacy and data-exposure risk because sensitive prompts, secrets, or proprietary content may be transmitted off-host without granular filtering or minimization.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script silently POSTs conversation-derived content to a remote service and discards all output, giving the user no visible indication that data was transmitted. In a persistent-memory skill, silent network transfer is especially risky because users may assume local-only handling while confidential material is being stored remotely.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The hook transmits the user's latest message to a remote API for semantic memory search without any user-facing notice or per-request consent in the script itself. In a pre-tool-use hook, this is particularly sensitive because prompts may contain secrets, proprietary data, or regulated information, and the transmission happens automatically whenever the feature is enabled.

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: The diagnose command prints the first 7 characters of the API key, which unnecessarily exposes credential material to anyone with terminal visibility, logs, screenshots, or shell session recording. Partial key disclosure is lower severity than full disclosure, but it still aids key identification and can leak secrets into operational artifacts.

External Transmission

Medium

• Category: Data Exfiltration

Content

json_body=$(jq -n --arg q "$USER_MESSAGE" '{"query":$q,"limit":5,"threshold":0.5}')

# Query for relevant memories
response=$(curl -s -X POST "${API_BASE}/memory/search" \
    -H "Authorization: Bearer ${API_KEY}" \
    -H "Content-Type: application/json" \
    -d "$json_body" 2>/dev/null || echo "{}")

• Confidence: 94% confidence
• Finding: curl -s -X POST "${API_BASE}/memory/search" \ -H "Authorization: Bearer ${API_KEY}" \ -H "Content-Type: application/json" \ -d

Credential Access

High

• Category: Privilege Escalation

Content

echo ""
    echo "Option 2 - Credentials file:"
    echo "  mkdir -p ~/.config/neutron"
    echo '  echo '"'"'{"api_key":"nk_your_key"}'"'"' > ~/.config/neutron/credentials.json'
    exit 1
fi

• Confidence: 82% confidence
• Finding: credentials.json

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.