Security audit

Memory Store

Security checks across malware telemetry and agentic risk

Overview

This is a local memory skill that persistently stores and searches conversation summaries, with disclosed plaintext storage and installer behavior and no evidence of hidden networking, exfiltration, or destructive actions.

Install only if you want a persistent local memory store shared across agent sessions. Keep the profile at explicit or off unless you want automatic memory behavior, do not store passwords, tokens, keys, or raw personal data, and use --dry-run plus a specific --agent or --target instead of --all unless you intend to modify every detected agent installation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill instructions direct execution of a Node.js CLI that relies on environment-derived agent identity and likely accesses environment variables, yet the skill declares no corresponding permissions or capability disclosure. This creates hidden trust and data-flow risks because an agent may read or depend on sensitive environment state without the user understanding that scope.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose frames the skill as a constrained memory manager, but the referenced behavior includes host scanning, cross-platform installation/synchronization, global config writes, direct filesystem mutation, transcript parsing, and broader maintenance operations. This mismatch is dangerous because it hides materially broader execution and persistence capabilities than a user would reasonably expect, increasing the chance of unauthorized file access, unwanted propagation, privacy leakage, and persistence across tools.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The manifest explicitly enables implicit invocation while the skill description says memory access/storage must not occur automatically in off/explicit modes. For a cross-session memory skill, this mismatch can cause unauthorized recall or persistence of user data, undermining consent boundaries and privacy expectations across agents.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The `compress` command accepts an arbitrary `--input` path and reads the entire file, then extracts and emits conversation fragments. In a memory-management skill, this creates a broader local file-reading capability that could be abused to exfiltrate sensitive transcript or JSON data from unintended locations, especially if another agent/tool can invoke the CLI with attacker-controlled paths.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: In non-interactive flows such as --all, --agent, or --target, the script proceeds to install into auto-detected or user-specified directories without a final explicit confirmation or a strong warning summarizing what will be modified. This can cause unintended persistent changes across multiple agent environments, especially when invoked indirectly from package hooks, wrapper scripts, or copied commands.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: configureMemoryProfile writes a persistent config file to ~/.memory-store/config.json whenever installation succeeds and --memory-profile is supplied, but non-interactive paths do not present a standalone warning that a cross-session home-directory setting will be created or overwritten. This creates durable behavioral change outside the target install directory, which increases surprise and the risk of policy changes being applied unintentionally.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: test/cli_experience_contract.js:21

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: test/config_contract.js:21

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: test/install_contract.js:33

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: test/smoke.js:29