vestige

• Outcome: Pass
• Latest audit: Sep 8, 2026 · 11:36 PM UTC
• Version: 1.0.5

Overview

This is a disclosed local memory wrapper whose main risks are expected persistence and reliance on an external pinned npm MCP server.

Install only if you are comfortable running the pinned Vestige npm MCP server locally. Use a per-project --data-dir for sensitive projects, avoid saving secrets, and review what the agent is about to store when casual preference phrases are used.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24
• Finding: Globally Installed Third-Party MCP Package Executes Outside the Audited Codebase## Vulnerability Details **File Location**: `SKILL.md`, lines 24-28 **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium **Complete Code Snippet**: ```bash npm install -g vestige-mcp-server@2.8.0 which vestige-mcp # macOS / Linux where vestige-mcp # Windows ``` The same installation instruction is repeated in `README.md`, lines 18-23. The helper also recommends this installation when the executable is unavailable in `vmem`, lines 13-14: ```bash echo "vestige-mcp not on PATH. Install with: npm install -g vestige-mcp-server@2.8.0" >&2 echo "Then re-open this shell so command -v vestige-mcp resolves." >&2 ``` ### Technical Analysis The Skill directs users to install `vestige-mcp-server@2.8.0` globally from the npm registry and subsequently execute the package-provided `vestige-mcp` binary. Although the dependency version is pinned, the project does not include the package source, a dependency lockfile, an integrity hash, a signature, or a vendored executable that would allow the installed implementation to be verified as part of this audit. npm packages can execute lifecycle scripts during installation. A global installation also exposes the package-provided executable to the user's environment. The installed binary is then launched as an MCP server by OpenClaw or by the included `vmem` helper. Consequently, the effective executable behavior depends on an external supply-chain component that is outside the reviewed project. No evidence was found that the included project files themselves are malicious, and the audit did not establish that the referenced npm release is compromised. The risk arises from trusting and globally executing an external package without project-supplied integrity verification or isolation. ### Attack Path 1. An attacker compromises the referenced npm package release, its publishing account, registry delivery path, or an unresolved transitiv ...[truncated 1300 chars]
• Remediation: ## Remediation Suggestions 1. Avoid recommending an unrestricted global installation. Prefer a project-local installation with a committed lockfile and deterministic dependency resolution. 2. Publish and verify cryptographic checksums or signed provenance for the expected package archive and executable before running them. 3. Vendor the reviewed executable or source when feasible so that the implementation executed by the Skill matches the audited artifact. 4. Install with lifecycle scripts disabled where compatible, such as `npm install --ignore-scripts`, and explicitly perform only required build steps after review. 5. Pin the complete transitive dependency graph rather than only the top-level package version. 6. Run the MCP server under a dedicated, least-privileged account or sandbox with narrowly scoped filesystem access and no unnecessary network access. 7. Provide the server only the environment variables it requires; do not inherit credentials or unrelated secrets. 8. Add an update process that requires source review, integrity verification, and regression testing before changing the pinned release.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrases include broad, common language such as "Remember this," "Don't forget," and especially habit/preference patterns like "I always..." or "I prefer..." that can appear in ordinary conversation without explicit consent to persist data. In a memory skill, this can cause unintended writes of user content or inferred preferences, increasing privacy risk and creating opportunities for prompt-injection-style manipulation through casual phrasing.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script forwards arbitrary user-provided query and content data to the external `vestige-mcp` process for `recall` and `smart_ingest` without any explicit notice, consent prompt, or indication of where that data may be stored or processed. Even though the skill is described as local-first, the data still crosses a process boundary into another tool, which can surprise users and expose sensitive memory content if the MCP server is misconfigured, replaced on PATH, or logs requests.

Static analysis

No suspicious patterns detected.