Simplemem

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:23 PM UTC
• Version: 1.0.1

Overview

This is a coherent SimpleMem memory skill, but users should understand that memories persist on disk and may be processed by OpenAI-backed services when an API key is used.

Install only if you are comfortable with a persistent memory tool. Do not store secrets, credentials, regulated personal data, or confidential business content as memories. If you enable OPENAI_API_KEY, assume memory and query text may leave the local machine for SimpleMem/OpenAI-backed processing. Prefer a pinned dependency version or reviewed commit, and review or delete artifact/data/memories.json when you want to clear local memory.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:23
• Finding: Unpinned Third-Party Dependencies Permit Supply-Chain Code Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 23-30 **Vulnerability Type**: Unpinned and mutable third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```powershell # Install Python dependency pip install simplemem # Or via repo git clone https://github.com/aiming-lab/SimpleMem.git cd SimpleMem pip install -r requirements.txt ``` ### Technical Analysis The installation instructions retrieve and install executable third-party code without pinning a package version, Git commit, dependency lockfile, or integrity hash. The `pip install simplemem` command resolves the package version and its transitive dependencies at installation time. The alternative Git installation retrieves the repository's mutable default branch and then installs dependencies from its potentially mutable `requirements.txt`. Consequently, the code installed by a user can differ from the code that was reviewed. Python package installation can execute package build hooks and subsequently run imported package code. The wrapper imports `simplemem` at module initialization, so a compromised distribution could execute when the wrapper starts. ### Attack Path 1. An attacker compromises the `simplemem` package, its source repository, or one of its unpinned transitive dependencies. 2. The attacker publishes malicious installation or runtime code under an otherwise expected package or branch. 3. A user follows the documented `pip install` or `git clone` instructions. 4. The malicious code executes during installation or when `simplemem.py` imports the dependency. 5. The code runs with the privileges of the installing or invoking user and may access files, environment variables, and network resources available to that account. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the privileges of the user installing or running the Skill. Accessible data may include local memory files, conversation-related data, and en ...[truncated 246 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `simplemem` to a specifically reviewed version: ```powershell python -m pip install "simplemem==<reviewed-version>" ``` 2. If installation from Git is required, pin a full verified commit hash rather than cloning a mutable default branch. 3. Publish a lockfile that pins all transitive dependencies. 4. Require package hashes, such as through a hash-locked requirements file and `pip install --require-hashes`. 5. Review package build configuration and dependencies before approving upgrades. 6. Install the dependency in an isolated virtual environment or container with least privilege. 7. Restrict access to credentials and sensitive local files during installation and first execution. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: simplemem.py:48
• Finding: Persistent Memories Are Stored in Plaintext with Weak Caller Isolation<![CDATA[ ## Vulnerability Details **File Location**: `simplemem.py`, lines 48-100 **Vulnerability Type**: Plaintext sensitive-data persistence and shared default user namespace **Risk Level**: Medium ### Vulnerable Code ```python # Fallback to JSON storage memories_file = self.data_dir / "memories.json" if memories_file.exists(): with open(memories_file, 'r', encoding='utf-8') as f: memories = json.load(f) else: memories = {} if user_id not in memories: memories[user_id] = [] memory = { "content": content, "metadata": metadata or {}, "timestamp": str(Path(__file__).stat().st_mtime) } memories[user_id].append(memory) with open(memories_file, 'w', encoding='utf-8') as f: json.dump(memories, f, ensure_ascii=False, indent=2) return True def retrieve(self, query, user_id="osiris", limit=5): """Recuperar recuerdos relacionados""" if self.system and self.api_key and self.api_key != "test": try: results = self.system.retrieve(query, user_id=user_id, top_k=limit) return [{"content": r.content, "score": r.score} for r in results] except Exception as e: print(f"SimpleMem retrieve failed: {e}") # Fallback to JSON search memories_file = self.data_dir / "memories.json" if not memories_file.exists(): return [] with open(memories_file, 'r', encoding='utf-8') as f: memories = json.load(f) user_memories = memories.get(user_id, []) query_words = set(query.lower().split()) results = [] for mem in user_memories: content_words = set(mem["content"].lower().split()) score = len(query_words & content_words) if score > 0: ...[truncated 2227 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require an explicit, authenticated caller identity instead of defaulting to `osiris`. 2. Derive storage namespaces from a trusted identity source rather than caller-controlled input. 3. Enforce authorization checks before adding or retrieving memories. 4. Create the data directory and memory file with owner-only permissions, such as `0700` for directories and `0600` for files on supported systems. 5. Encrypt sensitive memory content at rest using a managed key stored separately from the data. 6. Use atomic writes and secure file creation to avoid permission races and partial-file corruption. 7. Define retention limits and provide secure deletion and user-data export controls. 8. Document that conversation secrets, credentials, and authentication tokens must not be stored as ordinary memories. 9. For multi-user deployments, use a storage system that provides per-user access controls instead of a single shared JSON document. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Credential Access

High

• Category: Privilege Escalation

Content

if __name__ == "__main__":
    import sys
    
    # Get API key from args or env
    api_key = os.getenv("OPENAI_API_KEY", "")
    wrapper = SimpleMemWrapper(api_key=api_key)

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises capabilities that imply environment-variable access and local file read/write, but it does not declare any explicit tool scope or permissions boundary. This weakens least-privilege controls and makes it easier for an agent or operator to invoke the skill without understanding that it can persist data and access sensitive configuration such as API-key-backed behavior.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly provides cross-session persistent memory, but the description does not warn users that interaction data may be stored beyond the current conversation. This creates a privacy and consent risk because users or agent operators may supply sensitive data without realizing it will be retained and reused later.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The configuration section says that providing an OpenAI API key enables full features, but it does not clearly warn that user content or stored memories may be transmitted to OpenAI for embeddings or related processing. This is dangerous because operators may assume processing remains local when enabling the key, leading to unintentional third-party data disclosure.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: If an API key is present, the wrapper sends supplied content to an external SimpleMem/OpenAI-backed system during initialization and later operations without any user-facing disclosure or consent mechanism. This can leak sensitive prompts, memories, or identifiers to a third-party processor, especially in agent contexts where inputs may contain confidential data.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: When the primary backend is unavailable, the wrapper silently falls back to storing memory contents and metadata in a local JSON file. This persists potentially sensitive user data to disk without any consent flow, warning, retention policy, or access control, which can expose private data to other local users, backups, or later compromise of the host.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The PowerShell usage comments and example content are written in Spanish while the rest of the skill description is in English, and the document does not indicate that the skill is intentionally locale-specific or that users may choose their preferred language. This creates a natural-language locale inconsistency that can violate language policy expectations.

Natural-Language Policy Violations

Low

• Confidence: 70% confidence
• Finding: Several docstrings and comments such as 'Wrapper para usar SimpleMem desde OpenClaw' and 'Funciones CLI simples' are written in Spanish, which can impose a language expectation on users or maintainers without opt-in. No justification or alternative language choice is provided in the file.

Static analysis

No suspicious patterns detected.