Security audit

MAMP

Security checks for vulnerabilities and agentic risk

Overview

This memory skill is local-only, but it can passively wrap agent methods to record conversations and its current code contradicts parts of its own safety documentation.

Install only after reviewing and constraining auto_record. Prefer explicit add_turn() calls, set a dedicated db_path or MARK_MEMORY_DB location with proper filesystem permissions, avoid storing secrets or regulated data, and verify the published code matches the changelog claims about cwd-only storage and removal of platform_info persistence.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (31)

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Content: else: role = "assistant" try: original = getattr(mod, attr_name) # Create wrapper closure def make_wrapper(orig, r): def wrapper(*args, **kwargs):
Confidence: 93% confidence
Finding: This dynamic attribute access is part of a broader auto-record feature that scans loaded modules and monkey-patches arbitrary callables. In this context, the danger is not `getattr()` by itself, but that it enables interception of unrelated module methods and passive capture of message content without clear scope limits or consent.

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Content: if attr_name.startswith("_"): continue # Look for message-sending methods if not callable(getattr(mod, attr_name, None)): continue # Role detection: "user" or "say" → user role, else assistant lower_name = attr_name.lower()
Confidence: 90% confidence
Finding: Here `getattr(mod, attr_name, None)` is used while iterating across arbitrary loaded modules, which can trigger descriptor code or interact with unexpected attributes during broad runtime inspection. Within this skill's auto-record design, it contributes to unsafe capability expansion from local memory storage into passive interception of agent behavior.

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Content: for attr_name in dir(mod): if attr_name.startswith("_"): continue top_obj = getattr(mod, attr_name, None) if top_obj is None: continue # Check both the top-level callable AND instances/classes inside it
Confidence: 88% confidence
Finding: This getattr() use is part of a broad sys.modules scan that inspects arbitrary loaded modules in order to discover candidate methods for monkey-patching. In this skill's context, the dynamic attribute access is not harmless reflection; it enables passive interception of message flows across unrelated modules, which can capture sensitive prompts or responses without explicit integration boundaries.

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Content: for sub_name in dir(top_obj): if sub_name.startswith("_"): continue sub_obj = getattr(top_obj, sub_name, None) if sub_obj is not None and callable(sub_obj): candidates.append((f"{attr_name}.{sub_name}", sub_obj, top_obj)) if not candidates:
Confidence: 88% confidence
Finding: This second getattr() traverses sub-attributes of discovered objects/classes and expands the monkey-patching surface even further. In practice it allows the skill to enumerate and hook nested callables it was never explicitly granted access to, increasing the risk of covert data capture and unstable behavior across the host agent runtime.

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Content: for attr_name in dir(mod): if attr_name.startswith("_"): continue top_obj = getattr(mod, attr_name, None) if top_obj is None: continue # Check both the top-level callable AND instances/classes inside it
Confidence: 93% confidence
Finding: This getattr() use is part of a broader auto-record feature that scans loaded modules by name pattern and inspects their attributes for candidate methods to wrap. In this skill context, the dynamic access is not just reflective bookkeeping: it enables runtime discovery of arbitrary agent objects for passive interception of message content, which exceeds the stated local-memory purpose and creates covert data-capture risk.

Dynamic attribute access via getattr()

Low

Category: Dangerous Code Execution
Content: for sub_name in dir(top_obj): if sub_name.startswith("_"): continue sub_obj = getattr(top_obj, sub_name, None) if sub_obj is not None and callable(sub_obj): candidates.append((f"{attr_name}.{sub_name}", sub_obj, top_obj)) if not candidates:
Confidence: 93% confidence
Finding: This second getattr() walks sub-attributes of discovered objects/classes, expanding the interception surface from top-level module attributes to nested methods. That makes passive capture broader and less predictable, increasing the chance of wrapping unrelated functions and recording sensitive strings from arbitrary calls.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares only high-level security metadata, but the content clearly indicates environment-variable use and local filesystem read/write behavior. Undeclared capabilities are dangerous because they prevent accurate risk gating by the host platform and can cause agents or users to trust the skill more than they should, especially since it persists plaintext conversation history to disk.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This is a significant description-behavior mismatch: the skill presents itself as a simple local SQLite memory tool, but the analyzed behavior includes passive interception via monkey-patching, host/environment fingerprinting, persistence of system metadata, and use of fixed external paths and lock files. That mismatch is dangerous because it can lead to silent capture of more data than expected, storage outside the advertised location, and deployment into environments that would have rejected the skill if its full behavior were disclosed.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The import routine claims compatibility validation but only logs a warning when presented with a newer schema and still imports untrusted session data. In a memory skill, this is more dangerous because imported content becomes persistent agent memory, which can enable memory poisoning, corrupted state, or downstream logic failures if newer-format fields are misinterpreted.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The skill advertises persistent session memory, but the auto-record feature silently monkey-patches loaded modules to intercept outbound messaging. That is a materially different and more sensitive capability than local storage, because it can capture data from unrelated agent flows and persist it without explicit caller action.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Runtime scanning of `sys.modules` and monkey-patching methods is unjustified for a local SQLite memory component and expands its privileges into process-wide behavioral interception. This creates a broad attack surface, risks compatibility breakage, and can capture sensitive strings from any matching callable, not just intended chat sends.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The documentation claims outbound message wrapping, but the wrapper records the first non-empty string argument before calling the original method. That means it may capture prompts, internal parameters, identifiers, or unrelated string inputs from scanned callables, exceeding the documented scope and increasing accidental data collection risk.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The auto-record feature monkey-patches other loaded modules to capture message content passively, which is a significant capability escalation beyond a normal local memory helper. Because it hooks message-sending methods automatically, it can collect sensitive user inputs, agent outputs, or internal prompts without explicit per-call consent or clear auditability.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The code can monkey-patch loaded modules and agent methods to automatically capture outbound content, which materially contradicts the 'SQLite-only local memory' description and expands the trust boundary beyond the local database. In an agent skill, this enables covert interception of user/agent messages from unrelated components without explicit call sites, making sensitive-data collection much more dangerous.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Runtime introspection over sys.modules plus method wrapping is far more powerful than necessary for a local session-memory library and creates an implicit surveillance mechanism inside the host process. Because it can alter behavior of arbitrary loaded modules, it introduces integrity and confidentiality risks, including accidental capture of secrets and hard-to-debug side effects.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The manifest presents the skill as a lightweight local memory store, but the implementation performs environment fingerprinting and persists host-identifying data such as hostname, OS, architecture, and Python executable. This creates a mismatch between stated purpose and actual collection behavior, which can expose infrastructure details useful for profiling or later attacks.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The auto-record feature scans loaded modules and monkey-patches methods to capture message content passively, far beyond a normal explicit memory API. In an agent skill, this is dangerous because it can silently intercept and persist conversations from unrelated components without clear boundaries or consent, increasing the chance of over-collection of sensitive data.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The code collects host fingerprinting details unrelated to core session-memory storage, including hostname, container status, architecture, Python version, and executable path. In the context of an agent skill, this broadens the data collected beyond necessity and can leak sensitive environmental information that helps attackers tailor exploitation or map infrastructure.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README advertises an auto-record mode that captures conversation turns automatically, but it does not warn about privacy, consent, retention, or handling of sensitive data. For a memory component intended to persist AI conversations across sessions, this omission can lead integrators to deploy silent logging of user content, credentials, personal data, or confidential business information without appropriate notice or safeguards.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The invocation guidance is overly broad for a persistence skill that stores conversation history, which increases the chance the agent will activate it in contexts involving sensitive personal, financial, or regulated data without clear consent boundaries. In this skill's context, broad triggers are more dangerous because the system is specifically designed to retain and later retrieve user-provided information across sessions.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: This method persists externally supplied JSON directly into the local memory database without any confirmation, trust check, or quarantine workflow. In the context of an AI memory system, silently importing untrusted conversation history can poison future retrievals, insert deceptive instructions into agent memory, and create persistent integrity issues.

Missing User Warnings

High

Confidence: 98% confidence
Finding: Automatic passive capture is enabled in code without any user-facing warning, confirmation, or runtime notice beyond constructor configuration. For a memory skill handling conversation content, silent recording materially increases privacy risk because users and integrators may not realize unrelated messages are being intercepted and persisted.

Missing User Warnings

High

Confidence: 98% confidence
Finding: Passive auto-record stores message content by wrapping message-sending methods without any user-facing warning, consent gate, or explicit invocation at the call site. In a memory skill, silent recording is especially dangerous because the captured content may include secrets, private user data, system prompts, or regulated information that callers did not intend to persist.

Missing User Warnings

High

Confidence: 98% confidence
Finding: Automatic passive memory capture records message content without any user-facing notice or confirmation, and does so by wrapping detected methods rather than requiring explicit add_turn() calls. In a memory skill, that means sensitive prompts, responses, and incidental string arguments may be persisted silently, which is a significant privacy and security issue.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: Platform-identifying data is collected automatically and later persisted without any obvious user-facing notice or local disclosure in code flow. Silent collection of environmental metadata in a memory skill undermines transparency and can surprise operators who expect only conversation memory to be stored.

Static analysis

No suspicious patterns detected.