Security audit

memU: Persistent Memory for 24/7 Agents

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a legitimate persistent-memory tool, but it handles long-lived user data and sends examples through external services without enough visible privacy and retention guardrails.

Review before installing. Use this only with data you are allowed to store and send to configured providers, define a retention and deletion process first, avoid secrets or regulated data, disable or redact debug logging, and prefer local or self-hosted deployment for sensitive work.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The FAQ explicitly promotes use of external LLM and Cloud API services for memory ingestion and retrieval, which can involve transmitting conversation content to third parties, but it does not clearly warn users about privacy, retention, or compliance implications. In a persistent-memory skill, this is especially relevant because stored conversations may contain sensitive long-lived personal or organizational data, increasing the chance of unintended disclosure.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README promotes persistent collection and proactive use of conversations, documents, images, logs, and user identifiers, but it does not prominently warn users about privacy implications, retention, consent, or sensitive-data handling. In a memory framework intended for always-on agents, this omission increases the risk that deployers ingest personal or confidential data without appropriate notice or controls.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The hosted API example sends conversation payloads to a remote memU service, but the documentation does not clearly warn that user content will leave the local environment and be processed by a third party. This can lead developers to unknowingly transmit sensitive conversations or documents off-premises, creating privacy, compliance, and data-governance risk.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill promotes persistent cross-session memory but does not clearly warn users that their data may be retained long term. This can lead to accidental storage of sensitive personal, business, or regulated information without informed consent or appropriate handling expectations.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill advertises proactive retrieval of prior context but does not warn that this may unexpectedly resurface previously stored sensitive information. In agent workflows, that increases the risk of confidential data being injected into prompts, shown to users, or used in unrelated tasks without contextual appropriateness.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The example prints retrieved memory context directly to stdout, which can expose personalized or sensitive historical data in logs, terminals, CI output, or shared observability systems. In a persistent-memory agent, retrieved memories may contain private user details, making debug output a meaningful confidentiality risk.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This example configures external OpenAI and PostgreSQL services and then stores user conversation content via memorize(), but provides no consent, disclosure, retention, or data-handling safeguards. In a memory system intended for long-lived agents, silently persisting user messages increases privacy and compliance risk if operators deploy the example as-is.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The example sends conversation content and operational/system-event data to OpenAI via the configured MemoryService without any in-file disclosure, minimization, or safeguards. In this skill context, that matters because the scenarios include potentially sensitive user preferences, email-triage rules, and production monitoring details that could expose internal or personal information to a third-party processor.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.