Security audit

Supercharged Memory

Security checks across malware telemetry and agentic risk

Overview

This is a real memory skill, but it needs review because it silently records, rewrites, and reuses personal/work context by default, with optional external sync/vector paths that are not fully scoped.

Install only if you deliberately want always-on long-term memory in that workspace. Review and edit MEMORY.md and the memory/ directory regularly, avoid secrets or regulated personal data, and be especially cautious before enabling the Vector DB or dashboard sync because those options may process or store memory data outside the local workspace.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (19)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The optional upgrade directs the user to install and run additional software outside the workspace, including Docker/Qdrant and a Python virtual environment in the home directory. This expands the trust boundary, introduces supply-chain and local-environment risks, and can cause the agent to influence system state beyond the project without an explicit consent gate.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The setup flow asks the user for an embedding provider API key as part of enabling the vector database workflow. Requesting secrets in conversational setup is risky because users may paste credentials into logs or agent-visible context, and the feature also implies external transmission of embedded data to a third-party provider.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README advertises automatic context capture, preference storage, and persistent memory, but it does not clearly warn users that conversation content and personal details will be written into workspace files by default. This can lead to inadvertent storage of sensitive information, especially in shared workspaces, synced folders, backups, or repositories, making the privacy and data-retention risk easy to underestimate.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The setup sequence tells the agent to create directories and modify files immediately, but it does not first require an explicit warning and user approval for those filesystem changes. Silent or assumed modification of the workspace weakens user control and increases the chance of unintended writes or trust abuse.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The vector DB setup asks for an embedding API key without a strong privacy warning about external data processing and without a prohibition on sharing secrets in chat. This can lead users to expose credentials and misunderstand that their memory content may be transmitted to a remote embedding service.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill advertises persistent, cross-session memory capture 'forever' and auto-activation on every session without a clear upfront consent and privacy notice. This creates a real privacy risk because users may disclose sensitive personal or project information without realizing it will be stored durably and reused later.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The instruction to activate on every session start and on broad conversational cues can cause the skill to run in contexts the user did not explicitly intend, increasing the chance of silent data collection and autonomous file modification. Over-broad invocation is especially risky here because the skill persists user information across sessions.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The protocol requires continuous capture of user decisions, preferences, entities, and corrections into persistent files, but provides no corresponding user-facing warning at the moment of collection. This is dangerous because it enables silent retention of personal data, potentially including sensitive information, without informed consent or awareness.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The manual trigger phrase "clean up your notes" is vague enough to be used in ordinary conversation and may cause unintended consolidation without clear user intent. Because consolidation mutates memory files and can prune or migrate information, an accidental trigger could lead to silent state changes and loss or reshaping of stored context.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The rule instructs the agent not to announce consolidation unless asked, even though the process updates heartbeat state and may add, move, or prune memory entries. Silent modification of persistent memory reduces transparency and makes unauthorized or accidental state changes harder for the user to detect, especially when paired with broad triggers or automated heartbeat execution.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The spec explicitly centers a dashboard that exposes the agent's stored personal memory, including browsing, searching, editing, deleting, and optional syncing to Supabase, but it does not require a clear user-facing privacy notice, consent flow, or data minimization controls. In this context, the data is inherently sensitive, so normalizing broad visibility and optional external sync without explicit safeguards increases the risk of unintended disclosure, over-collection, or users not understanding where their personal data is being surfaced and stored.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The example explicitly states that memory consolidation performs file reads and writes silently and that the user sees nothing. Silent modification of persistent state can violate user expectations, obscure unintended or harmful changes, and reduce the chance that erroneous or manipulated updates are caught promptly. In this context, the risk is amplified because the modified files include long-lived memory artifacts that can influence future agent behavior.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The example explicitly depicts persistent memory writes and profile updates occurring automatically and invisibly to the user. This is dangerous because it normalizes silent retention of user data, including personal and project information, without clear notice, consent, or review controls, creating privacy and compliance risks.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The skill promises automatic capture and persistence of user-shared information into long-term memory files with broad wording and few minimization boundaries. That creates a privacy risk because sensitive personal, financial, health, or confidential project information may be stored by default without clear consent, retention, or scope limits.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The automatic capture rules are broad and include preferences, decisions, strategy discussions, and newly mentioned people/projects/tools, with no sensitivity classification or minimization rules. That can lead to over-collection of confidential, personal, or regulated data into long-term memory stores, increasing exposure if the workspace is accessed later or reused inappropriately.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The Vector DB capture flow instructs the system to summarize recent conversation history into another persistent memory layer every two hours. Without strict redaction and consent controls, this can propagate sensitive conversation content into external or additional stores, increasing the blast radius of privacy and confidentiality failures.

Ssd 3

Medium

Confidence: 96% confidence
Finding: This passage shows the agent reusing previously stored personal and contextual details such as age, timezone, project history, and the user's dog's name without explicit consent in the current session. Hidden retrieval and use of sensitive or identifying information can violate user expectations and expose private data in ways the user did not knowingly authorize.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The example instructs the agent to automatically record session details and update long-term memory from ordinary conversation, including schedule changes and work context. This is risky because it enables silent collection and persistence of user data without confirmation, which can lead to privacy harms, inaccurate records, and unintended downstream use.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The narrative goal explicitly celebrates the system silently remembering user information so it 'just knows' later, reinforcing non-transparent persistence as a feature. That makes the design more dangerous because it encourages broad hidden profiling and reuse of prior user data without meaningful user awareness or control.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: SKILL.md:18