Security audit

memory-cross-engine

Security checks for vulnerabilities and agentic risk

Overview

The skill's main memory-bus behavior is understandable, but it also keeps persistent task history, errors, and preferences without clear consent, retention, deletion, or scoping controls.

Review this before installing if tasks may include private prompts, business data, or personal preferences. The main script stays local and does not show exfiltration, but it is designed to persist task memory and learned preferences across runs, and the skill does not explain how to opt in, inspect, expire, redact, or delete that retained data.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill explicitly documents file-writing behavior (`memory_bus.jsonl` and `learned_patterns.json`) but declares no permissions, creating a capability/permission mismatch. In an agent environment, undeclared persistence is dangerous because it can bypass user expectations, policy gating, or sandbox review and enable silent retention of task data across runs.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared purpose is a cross-engine memory bus, but the skill also introduces a generic learning/telemetry subsystem that records usage history, failures, and user preferences. This hidden expansion of scope is risky because it broadens collection and persistence beyond what an operator would reasonably infer from the title/description, increasing privacy and misuse risk.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The self-evolving learner is a materially different subsystem from the advertised memory bus and adds persistent collection of operational metadata and preferences. Security-wise, undocumented secondary functionality increases attack surface and makes it easier to smuggle surveillance-like behavior into an otherwise benign-looking skill.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: Storing user preferences and failure telemetry is not clearly necessary for the stated task of sharing structured memory between engines during a long-horizon task. Collecting extra data without necessity violates data minimization principles and increases the chance of sensitive information being retained or repurposed.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill describes persisting user preferences, errors, and operational history but gives no explicit privacy notice, retention explanation, or deletion controls. This is dangerous because users may unknowingly disclose sensitive behavioral data that remains on disk across sessions and could later be accessed, correlated, or leaked.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: Persisting `memory_bus.jsonl` across sessions is core to the skill, but the documentation does not warn that cross-session task memory will be retained. Even when functionality is legitimate, undisclosed persistence can expose prior prompts, goals, checks, and linked facts to future runs or other components.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The skill instructs automatic reuse of stored language preference on future runs without renewed consent. This creates a privacy and autonomy issue because user preferences become sticky state that influences later interactions silently, and preference records may reveal personal or organizational attributes.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill persists all memory entries to a local JSONL file automatically whenever write() or link() is called, with no consent prompt, retention control, or indication to the caller that data will be stored on disk. In an agent context, payloads may contain sensitive prompts, user preferences, task data, or verification results, so silent persistence can create unintended data exposure and privacy/compliance risk.

Ssd 3

Medium

Confidence: 93% confidence
Finding: Persisting user preferences and operational history creates a natural-language data leakage risk because free-form notes, errors, and reflections can easily contain sensitive content copied from tasks or users. Once retained, this information may be retrievable in unrelated future contexts or exposed through filesystem access.

Static analysis

No suspicious patterns detected.