Persistent Memory — Local Markdown Context

• Outcome: Pass
• Latest audit: Jul 15, 2026 · 1:48 PM UTC
• Version: 0.8.0

Overview

This skill transparently manages local Markdown memory files for cross-session agent context, with no hidden execution or network behavior found.

Install only if you want compatible agents on the same machine or filesystem to share reviewed memory. Keep the memory folder free of secrets and highly sensitive personal data, use explicit memory commands when possible, and periodically inspect ~/.persistent-memory/ because its Markdown files are plain text.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The load trigger list includes broad natural-language phrases such as 'what do you know about me', which can appear in ordinary conversation and unintentionally activate cross-session memory reads. In this skill, unintended activation exposes locally stored personal context from prior sessions, so the ambiguity creates a real privacy and data-minimization risk even without malicious intent.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The condition 'the active conversation matches an entry in _index.md' is underspecified and leaves matching behavior to agent interpretation. That ambiguity can cause overbroad retrieval of unrelated memory files based on weak semantic similarity, exposing personal or project data that the user did not intend to load for the current query.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: Save and lifecycle triggers include common phrases like 'save this', 'add to notes', and similar natural-language commands that are likely to occur in normal dialogue. Because this skill performs filesystem writes and state mutations, accidental trigger collisions could cause unintended persistence of sensitive content or initiate archive/delete/recover workflows based on casual wording.

Session Persistence

Medium

• Category: Rogue Agent

Content

- Each **compatible agent** can discover this skill or has an equivalent fallback instruction.
- The agents use the **same local filesystem** and resolve `~/.persistent-memory/` to the same location.
- The active user has read/write permission for that location.

Two agents do not automatically share every historical conversation. They share only memory files saved into this folder and only when the conditions above hold.

• Confidence: 78% confidence
• Finding: The skill is explicitly designed to persist and share cross-session context across compatible agents via a shared local filesystem, which creates a real session-persistence and cross-agent data exposure risk. Even with user approval for writes, any compatible agent with access to the same path can read previously stored personal context, so sensitive or over-broad memory entries could be surfaced in later sessions or by another agent unexpectedly.

Session Persistence

Medium

• Category: Rogue Agent

Content

- each agent can discover this skill or an equivalent fallback instruction;
- the agents use the same local filesystem and the same `~/.persistent-memory/` path;
- the active user has permission to read and write that path.

Platform memory may coexist. Persistent Memory does not import historical chats or replace an agent's built-in memory.

• Confidence: 91% confidence
• Finding: The skill is explicitly designed to persist user context across sessions in a shared local directory accessible by compatible agents. Even though this appears intentional, session persistence is security-relevant because it centralizes personal context in a reusable store, increasing the blast radius of accidental reads, prompt-trigger collisions, local compromise, or misuse by another compatible agent on the same filesystem.

Static analysis

No suspicious patterns detected.