Security audit

Memory Optimization

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly fits memory management, but it needs Review because it includes an unrelated browser-skill override/install path and can send conversation memory plus API credentials to configurable remote endpoints.

Install only after reviewing or removing the gstack section, pinning dependencies, and ensuring LLM endpoints are trusted HTTPS providers. Treat session-log extraction and working-memory compression as sensitive operations because they may transmit prior conversation content and API credentials to the configured endpoint.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: CLAUDE.md:258
Finding: Repository Instructions Mandate an Unrelated External Browsing Skill
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: CLAUDE.md:262
Finding: Mutable Remote Repository Is Cloned and Its Setup Script Is Executed
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/utils/llm_client.py:37
Finding: Conversation Memory and API Credentials Can Be Sent to an Arbitrary Configured Endpoint
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: CLAUDE.md:256
Finding: Dependency Installation Guidance Uses an Unpinned Package
Content: View full analysis
Remediation: View remediation
`. 2. Generate and verify package hashes using a locked requirements file. 3. Install with `pip install --require-hashes -r requirements.txt`. 4. Define and enforce a trusted package index rather than relying on arbitrary user configuration. 5. Use an isolated virtual environment with only the permissions required by the Skill. 6. Automate dependency vulnerability and update review while retaining reproducible version pins. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/daily-cleanup.sh:31
Finding: Cleanup Script Uses a Predictable Shared Temporary File and Unnecessary eval
Content: View full analysis
/tmp/cleanup-task.log 2>&1; then echo -e "${GREEN}✅ $task_name completed${NC}" ((TASKS_COMPLETED++)) return 0 else echo -e "${RED}❌ $task_name failed${NC}" ((TASKS_FAILED++)) return 1 fi } ``` ### Technical Analysis The script redirects output to the fixed path `/tmp/cleanup-task.log`. Shared temporary directories are normally writable by other local users. Shell redirection follows symbolic links, so an attacker may pre-create that path as a symlink to another file. If the victim has write permission to the symlink target, opening the log with `>` truncates and overwrites the target. The fixed name also allows other users to monitor or manipulate cleanup output. The function additionally passes command strings to `eval`. Current call sites observed during the audit use internally constructed commands rather than direct untrusted user input, so direct command injection is not presently established. Nevertheless, `eval` unnecessarily expands the attack surface and can turn future path or argument changes into command injection. ### Attack Path 1. A local attacker who can write to `/tmp` removes or races the predictable log path. 2. The attacker creates `/tmp/cleanup-task.log` as a symbolic link to a file writable by the victim. 3. The victim runs `scripts/daily-cleanup.sh`. 4. Shell redirection opens the symlink target with truncation before executing the check. 5. The target file is emptied or replaced by task output. 6. If future callers pass attacker-controlled text to `run_task`, `eval` could ...[truncated 577 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (194)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description promises a broad memory-management and context-reconstruction capability for AI agents. However, the supplied code does not implement memory management, context rebuilding, tagging, cleanup, knowledge graphs, or any of the listed features. Its actual purpose is narrow and different: formatting a benchmark comparison report between a baseline and a memory-optimization variant. This is a material description-behavior mismatch rather than a minor supporting utility detail, because the code’s primary function is performance reporting, not memory-system functionality.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description promises a full memory-management optimization framework with specific memory features and maintenance mechanisms. The supplied code chunk instead serves as a top-level benchmark harness: it parses CLI arguments, runs a baseline agent and a memory-enabled agent, and prints a generated report. That is materially different from directly providing the described memory system capabilities. While benchmarking such a skill could be related support infrastructure, this code chunk itself does not implement or expose the advertised memory-management features, so the description does not accurately represent this code's actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a broad memory-optimization framework for AI agents, emphasizing summary systems, structured memory files, tagging conventions, daily maintenance, HEARTBEAT integration, and knowledge-graph support. The supplied code does not implement those advertised features. Instead, it is a narrow operational tool for archived-memory cold storage management. It can enumerate archived entities, text-search their stored original content, recover entities from cold storage, permanently delete archive references and files, compute archive statistics, and purge old archives. While there is some overlap with the general theme of memory management and knowledge-graph integration, the actual primary purpose is materially different and includes undeclared destructive capabilities (delete/purge) and CLI archive administration behaviors not represented in the description. Therefore this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The supplied code chunk does not implement a broad memory optimization framework. Instead, it is a narrowly scoped script for extracting semantic concepts from existing entities and adding them to a knowledge graph. While this partially overlaps with the declared 'Knowledge Graph integration,' the description emphasizes many other features—summarization, file-pattern memory structure, cleanup automation, HEARTBEAT, and testing—that are absent from this code. The code’s primary behavior is materially different from the declared comprehensive memory-management purpose, so this is a description/behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a broad memory-management framework for AI agents, including summarization workflows, structured memory files, maintenance automation, and integration features. The supplied code chunk does not implement those functions. Instead, it specifically operates on a concept/ontology graph via is_a and synonym_of relationships, providing traversal, ancestor discovery, LCA computation, tree building, and simple validation. While this could be a supporting piece of a larger knowledge-graph system, the chunk’s actual purpose is much narrower and materially different from the declared end-user description. Therefore this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description presents a broad memory-management and maintenance framework for AI agents, with multiple organizational, summarization, automation, and integration features. The supplied code chunk does not implement those memory-management features. Instead, it is a specialized knowledge-graph script for concept-based querying and relation analysis. While the description mentions knowledge graph integration, that is only one small part of the declared scope, and this code only covers that narrow area. Therefore the actual behavior is materially narrower and different from the declared primary purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The supplied code is narrowly focused on one function: consolidating similar episodic memory records into semantic SkillCards, with LLM-assisted merge/conflict decisions and status reporting. That is related to memory systems, but it does not implement most of the prominently declared features such as TL;DR summaries, structured three-file memory management, daily maintenance automation, HEARTBEAT hooks, rolling summaries, or a testing framework. The description presents a broad memory-management toolkit, while the code chunk is specifically a consolidation/deduplication component. This is a material description-to-behavior mismatch in primary scope and provided capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code is narrowly focused on one subsystem of a memory system: batch decay and archival of knowledge-graph entities. It supports part of the declared description—specifically knowledge-graph-related maintenance and a form of cleanup automation—but it does not implement most of the prominently declared features such as summary generation, structured three-file memory organization, fixed tags, HEARTBEAT integration, rolling summaries, or a testing framework. The declared purpose presents the skill as a comprehensive memory-management toolkit, while the supplied code chunk is only a decay/archive maintenance utility. This is a material description-versus-behavior mismatch in scope and capabilities.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a broad memory-management framework for AI agents, emphasizing summaries, structured memory files, maintenance automation, and context restoration. The supplied code instead is a narrowly focused entity deduplication engine for a knowledge graph. Its concrete behaviors are embedding generation/caching, cosine-similarity comparison, duplicate detection among certain entity types, canonical selection by timestamp, graph update writes, and stats reporting. While this loosely relates to the declared 'knowledge graph integration' aspect, it does not substantiate the majority of the advertised features and has a materially different primary function. Therefore the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The description presents a broad, comprehensive memory-management skill with multiple maintenance and summarization features. However, the provided code chunk implements a much narrower function: extracting structured entities from prior session transcripts and inserting them into a knowledge graph. While 'Knowledge Graph integration' is part of the declared description, the code does not implement the majority of the advertised capabilities such as TL;DR summaries, structured three-file memory management, daily maintenance automation, HEARTBEAT integration, or testing utilities. This is therefore a material description-behavior mismatch: the actual primary purpose is KG extraction, not comprehensive memory optimization.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a broad memory optimization and maintenance capability for AI agents, including summarization, context rebuilding, daily automation, file-structure conventions, and KG integration. The supplied code only performs one specific KG-maintenance task: fixing missing entity type fields in a graph.jsonl file by inferring types from ID prefixes. While this could loosely fit under 'knowledge graph integration,' it is only a small supporting utility and not representative of the claimed primary purpose. Therefore, the description materially overstates and misrepresents what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The description presents a broad memory-management and optimization system focused on rebuilding context, structured summaries, maintenance automation, and knowledge-graph-backed memory practices. The actual code chunk does not implement those features. Instead, it analyzes existing memory entities and renders a dashboard/report for memory health. While this is related to a memory system and does integrate with a knowledge graph-like ontology source, its primary purpose is observability/diagnostics, not the declared optimization and maintenance workflow. This is a material description-behavior mismatch for the supplied code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The code is clearly related to agent memory and does use knowledge-graph retrieval, so it is not unrelated. However, the declared description presents a broad 'comprehensive memory management optimization' package with many concrete features: TL;DR summaries, three-file pattern, fixed tags, cleanup automation, HEARTBEAT integration, rolling summaries, testing framework, and KG integration. The supplied code implements only a narrower subset: loading/recovering memories from an ontology/KG in three stages, optional value-aware retrieval, basic hint generation, and statistics. That means the description materially overstates the implemented functionality. This is a mismatch because most of the advertised capabilities are absent, while the actual primary behavior is a startup/recovery memory loader rather than a comprehensive maintenance/organization framework.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 80% confidence
Finding: The description presents a broad memory-optimization system with multiple workflow features, while the provided code chunk is narrowly a shim for a memory ontology/knowledge-graph manager. There is partial overlap because the description mentions knowledge graph integration and memory system support, and the code clearly manages memory entities/relations. However, most prominently advertised features in the description are not represented in this chunk. Conversely, the code exposes several concrete ontology-management functions—decay thresholds, archival/cold storage, source reliability gating, schema validation, and graph operations—that are not described. Because the code’s actual purpose is materially narrower and somewhat different from the declared feature set, this is a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The description presents a broad memory-management framework centered on summarization workflows, structured memory files, automated maintenance, and integrations. The supplied code does not implement those features directly; it is an init.py that aggregates and re-exports a knowledge-graph memory ontology API. The actual behavior is focused on ontology management: entities, relations, schema validation, graph storage, decay, archival, write-time gating, and value-aware retrieval. Knowledge-graph integration is one declared aspect and is consistent, but most highlighted capabilities in the description are not represented in this chunk. Because the primary represented functionality is narrower and materially different from the declared feature set, this is a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The description presents a broad memory-management optimization system centered on structured summaries, maintenance workflows, and integration patterns. The supplied code chunk instead implements a specific command-line interface for managing a memory ontology/knowledge graph. Its concrete behaviors are operational graph/entity management tasks: creating entities, creating relations, querying, listing, validating, exporting markdown, showing statistics, compacting graph storage, evaluating write-time gating, listing archived entities, and performing value-aware retrieval. While there is some overlap with the declared 'knowledge graph integration' concept and general memory-system intent, the primary purpose and exposed capabilities in this chunk are materially different from the described feature set. Several prominently declared features are not represented here, while several significant implemented capabilities are undeclared. Therefore this is a description/behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The declared description presents a broad memory-management optimization skill with multiple user-facing subsystems and automation features. The supplied code chunk, however, is a specific backend module for ontology/entity operations in a graph-based memory store. It handles entity ID generation, validation, persistence operations, provenance fields, strength refresh, decay calculations, consolidation marking, and simple queries/statistics. While this partially aligns with the claim of 'knowledge graph integration' and memory management in a very general sense, it does not implement most of the headline features in the description such as TL;DR summaries, structured three-file memory pattern, fixed tags, daily maintenance automation, HEARTBEAT integration, rolling summaries, or a testing framework. The code’s primary purpose is materially narrower than the declared purpose, so the description does not accurately represent the actual behavior of this chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared description presents a broad memory-management framework for AI agents, including summarization workflows, structured file patterns, automated maintenance, and integration features. The supplied code does not implement those primary capabilities. Instead, it is a narrow ontology utility focused on querying entities, validating graph/schema consistency, and exporting graph contents to Markdown. While this loosely relates to the declared 'knowledge graph integration' aspect, it does not substantiate the much broader claimed functionality, so the description materially overstates and misrepresents what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The declared description presents a broad end-to-end memory management and optimization skill with multiple maintenance, summarization, organizational, and automation features. The supplied code chunk, however, is narrowly focused on retrieving entities from a memory ontology and ranking them by a computed value score. While this could support a knowledge-graph memory system, it does not implement most of the prominently declared features such as TL;DR summaries, file-pattern memory management, cleanup automation, HEARTBEAT integration, or rolling summaries. There is no evidence of inconsistent or dangerous resource access, but the primary purpose of this code chunk is materially narrower than the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The supplied code chunk is narrowly focused on schema loading and entity validation for a knowledge-graph or memory ontology component. It reads YAML schema files and checks entity fields for presence and basic type/enum validity. While this partially aligns with the declared mention of 'Knowledge Graph integration' and entity management, it does not implement the broader advertised memory-management system features such as summaries, structured memory files, automated maintenance, heartbeat integration, or testing. The primary purpose of the code is schema/validation infrastructure, which is materially narrower than the declared comprehensive memory optimization functionality.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The supplied code chunk is narrowly focused on persistent storage for a knowledge graph/ontology, including file locking, JSONL read/write, entity/relation loading, and graph compaction. This aligns with only one small part of the declared description: knowledge graph integration. The declared purpose presents a broad memory-management system with summarization, structured memory files, maintenance automation, and heartbeat/testing support, none of which are implemented in this code. There is no evidence of unrelated dangerous behavior or hidden external access beyond local filesystem operations for the graph store, but the description materially overstates the code’s capabilities and primary purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The description presents a broad memory-management skill for rebuilding context, maintaining structured summaries, automating cleanup, and integrating multiple memory workflows. The supplied code chunk instead performs a specific subtask: scoring entities for retrieval priority. It calculates weighted scores from existing entity metadata and sorts entities accordingly. While this could plausibly fit inside a larger memory system or knowledge graph, the chunk does not implement the declared core features such as summary generation, file-pattern management, maintenance automation, or restart-context rebuilding. Therefore the actual behavior is materially narrower and different from the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a broad memory-management system for AI agents, focused on context reconstruction, summaries, file-based memory organization, maintenance automation, and HEARTBEAT integration. The supplied code does not implement those functions. Instead, it specifically performs preference inference from conversation/KG entities by comparing task titles with an LLM, caching judgments, and creating Preference entities. While this loosely relates to the declared 'Knowledge Graph integration,' the primary purpose is materially different and much narrower. The code also exposes distinct triggers/operations (extract preferences, infer task similarity, list preferences, clear cache) that are not described. This is therefore a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a broad agent memory optimization system with summarization, context rebuilding, daily memory maintenance, file-pattern guidance, and knowledge graph integration. The supplied code does not implement those memory-management features. Instead, its primary purpose is operational telemetry: recording skill usage events, aggregating stats, and scanning recent session JSONL files for command patterns that imply skill use. While it references the memory-optimization knowledge graph and uses ontology functions if available, that is only a persistence/integration detail. The code’s actual behavior is materially narrower and different from the declared purpose, and it introduces undeclared capabilities such as session log scanning and usage analytics.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The description claims a full-featured memory management optimization system with multiple concrete capabilities. However, the provided code chunk is only an init.py file containing a docstring and no executable logic. This is a material mismatch between declared purpose and actual behavior of the supplied code. There are no undeclared risky capabilities; the issue is that the implementation shown does not substantiate the described functionality.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.