Security audit

neural-memory

Security checks for vulnerabilities and agentic risk

Overview

This memory skill is purpose-aligned, but it enables broad automatic capture and reinjection of conversation data with limited consent and safety controls.

Review this carefully before installing. Use a dedicated brain per project, disable autoCapture and autoContext unless you explicitly want cross-session memory, avoid using it in conversations containing secrets or regulated data, and verify the exact pip/npm packages and versions before running the install or build commands.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:26
Finding: Unpinned Executable Third-Party Dependencies
Content: View full analysis
npm run build ``` ### Technical Analysis The installation instructions retrieve the latest available releases of `neural-memory` from the Python package registry and `neuralmemory` from the npm registry without specifying exact versions, integrity hashes, or a lockfile. The npm package is installed globally and its package-controlled build script is subsequently executed. Package installation and build operations can execute package lifecycle hooks or other package-supplied code with the privileges of the installing user. Because the dependency source is not included in the audited project, its effective behavior—including the claim that memory remains local—cannot be independently verified from this artifact. The metadata also contains an inconsistent installation declaration: the package is described with `"kind":"node"` while its label refers to `pip install neural-memory`. In addition, the Python and npm package names differ. These inconsistencies increase the possibility of installing an unintended package or obscuring which dependency is authoritative. ### Attack Path 1. An attacker compromises the relevant registry account, publishes a malicious update, or takes control of an ambiguously named package. 2. A user follows the Skill instructions and installs the unpinned current packa ...[truncated 904 chars]
Remediation: View remediation

other

Warning

Location: SKILL.md:66
Finding: Automatic Persistent Capture and Reinjection of Conversation Data
Content: View full analysis
.db` - No data is sent to external services (unless optional embedding provider is configured) ``` The documented memory types also include `instruction`, allowing instruction-like content to be retained alongside facts, preferences, and other memory records. ### Technical Analysis The plugin is configured to inspect conversation content at the end of an agent run, extract selected information, store it persistently in a local SQLite database, and reinject relevant memories before later agent runs. This behavior is central to the declared memory functionality, but automatic capture without a review or confirmation boundary can retain sensitive content that users did not intend to preserve. Persistent reinjection also creates a context-poisoning risk. If adversarial or untrusted conversation content is extracted as a memory—especially as an `instruction`—it may be presented again in future sessions and influence subsequent agent behavior. The audited document does not establish trust labels, instruction/data separation, secret filtering, or user approval before per ...[truncated 1895 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The plugin advertises automatic context injection before each run and automatic capture of memories after conversations, but the skill does not present a prominent consent, retention, or privacy warning alongside those defaults. This is dangerous because users may unknowingly have personal, confidential, or regulated data persisted and later resurfaced across sessions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly tells the agent to use memory proactively for many common situations, including starting new tasks and remembering facts across sessions. That broad trigger surface increases the chance of collecting or resurfacing user data when it is unnecessary, which can lead to over-retention and accidental disclosure of prior context.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill promotes broad proactive memory capture and reuse across sessions without clear limits on sensitive categories of information. In a memory skill this context makes the behavior functional, but it also makes privacy risk more acute because persistent recall is the core feature and can expose stale or sensitive user data in later interactions.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Automatic post-conversation extraction normalizes logging and persistence of conversation content by default. If the conversation contains credentials, proprietary material, or personal data, the system may retain and later reveal it without the user's clear awareness or consent.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The workflow instructs the agent to process important conversation segments into persistent memory at session end, creating a routine path for storing user content. Without strict minimization and sensitivity checks, this can capture more information than necessary and preserve context that later becomes inappropriate to reveal.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.