Security audit

Memos Cli

Security checks for vulnerabilities and agentic risk

Overview

This skill is a mostly coherent Memos CLI helper, but it asks agents to install and run a mutable third-party executable with API credentials, which warrants review before use.

Review the upstream memos-cli source and pin a trusted version before installing. Use HTTPS for any non-local Memos server, provide the admin API key only for explicit admin user-inspection tasks, and confirm destructive memo operations before running them.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:8
Finding: Unpinned Installation of a Mutable Third-Party Executable
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:46
Finding: API Credentials May Be Transmitted over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly establishes memos-cli as the canonical entrypoint and warns agents not to use go run ., but later instructs go run . config check and go run . user list for an admin workflow. That contradiction can cause an agent to execute repository source directly instead of the installed binary, bypassing the skill's own safety assumptions and increasing supply-chain and execution-surface risk if the local checkout differs from the expected release.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 68% confidence
Finding: The description mandates use of this repository's CLI for relevant requests but does not mention any language or locale choice for user-facing interactions. If organizational policy requires respecting user language preferences, this instruction can be read as operationally prescriptive without clarifying that responses should still follow the user's chosen language.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This markdown file includes a workflow for listing users via the admin API and requires MEMOS_ADMIN_API_KEY, which is a sensitive credential. Although the document notes to ask for admin credentials if missing, this section does not explicitly warn that the command uses elevated privileges or may expose sensitive user/account data, so the user-facing safety disclosure is incomplete.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.