Security audit

NOVA Memory

Security checks across malware telemetry and agentic risk

Overview

This long-term memory skill is coherent, but it asks the agent to persist, reload, maintain, and sometimes commit user and system memory with too little user control.

Install only if you intentionally want an agent to keep long-term local memory about users, conversations, identity, and work context. Before enabling it, review any AGENTS.md edits, avoid storing secrets or sensitive personal data, disable cron and automatic commits unless explicitly wanted, and inspect or provide the referenced helper script before running it.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill expands from memory management into autonomous self-iteration, system modification, and Git commit behavior. That broadens agent authority beyond the stated purpose and can cause unintended code or configuration changes without a clearly bounded user request, increasing the risk of unsafe persistence and self-modification.

Context-Inappropriate Capability

Low

Confidence: 95% confidence
Finding: The session-loading rules instruct the agent to automatically read identity, user, and restart-context files on every session start, even when not necessary for the immediate task. This creates unnecessary access to potentially sensitive local data and widens the blast radius of the skill from memory architecture into general environment and profile ingestion.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The trigger conditions are broad enough that the skill may activate for many ordinary conversations about memory, architecture, or related concepts. Over-broad activation increases the chance that the agent will apply persistence and file-access behavior in contexts where the user did not intend to enable a long-term memory subsystem.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill directs routine reading of USER.md and system-related files at session start without any user-facing disclosure or consent mechanism. Silent access to privacy-sensitive files undermines user expectations and can expose personal or system context unrelated to the requested task.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The skill normalizes persisting and reloading user information across sessions, which can create long-lived profiles and context carryover without clear data minimization or retention controls. In a memory-system skill this is more dangerous because persistence is central to the design, so privacy-invasive behavior may become routine rather than exceptional.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.