Security audit

Memories Api

Security checks for vulnerabilities and agentic risk

Overview

The skill is a plausible Memories.ai API helper, but it ships an embedded API key and a hard-coded default webhook that can send async results somewhere the user did not choose.

Review carefully before installing. Do not use the included helper script unless the embedded API key is removed or revoked and async callbacks are explicitly set to a webhook you control. Treat media URLs, prompts, transcripts, uploads, ReID requests, and asset deletion as sensitive remote operations that may incur cost or expose private content.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

other

Error

Location: scripts/memories_api.py:40
Finding: Asynchronous analysis results are sent to a hard-coded external webhook
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/memories_api.py:21
Finding: Plaintext Memories.ai API credential embedded in source code
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill description and documented behavior are inconsistent, including references to unsupported capabilities and unmentioned behaviors such as comment retrieval, default credential use, and webhook behavior. This mismatch is dangerous because users and orchestrators may grant trust or permissions based on the declared purpose while the skill actually enables additional data flows or operational behaviors, increasing the risk of unintended exfiltration, misuse, or unsafe automation.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Human re-identification uses reference images to track people across videos, which is a sensitive biometric capability with elevated privacy, surveillance, and regulatory implications. Omitting a prominent warning in a general API skill makes misuse more likely, especially when an autonomous agent may treat it as a routine analysis feature.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script contains a hardcoded fallback API credential and automatically uses it when no environment variable is set. Embedding live secrets in distributable code is dangerous because anyone with access to the skill can reuse the credential for unauthorized API access, incur cost, and potentially access associated account data.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The fallback API key is used silently without warning or explicit user provisioning, causing the script to access a credential embedded in code. This creates secret leakage and unauthorized service consumption risk, especially because users may not realize they are operating under someone else's account or exposing that account to abuse.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/memories_api.py (reported line 22)May include surrounding context.
python
BASE_URL = "https://mavi-backend.memories.ai/serve/api/v2" def get_api_key(): """Get API key from environment or TOOLS.md""" if os.environ.get("MEMORIES_API_KEY"): return os.environ["MEMORIES_API_KEY"] # Default key from TOOLS.md

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill declares access to environment variables and demonstrates network-capable API usage, but it does not define an explicit tool/permission scope. That creates an authorization and transparency gap: an agent could access secrets like MEMORIES_API_KEY and send data to remote endpoints without a clearly bounded declaration of what tools and side effects are permitted.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill advertises destructive and data-transmitting operations such as upload, download, delete, clipping, splitting, and remote analysis, but it does not provide an explicit warning about external data transfer or destructive effects. In this context, users may unknowingly send sensitive media to a third-party API or delete remote assets without informed consent, which raises privacy, integrity, and cost risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file describes operations that may transmit or process sensitive user data, including audio/video streams, callback URLs, uploads, and human re-identification, but provides no user-facing warning about privacy, consent, or data-handling impact. Under the markdown-file criteria for missing user warnings, documentation should disclose behaviors that could affect user data or system integrity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The reference documents upload, callback, and multimodal chat operations that transmit user-supplied media and prompts to remote services, but it does not warn about privacy, retention, or third-party processing implications. In an agent context, users may unknowingly send sensitive videos, images, or transcripts off-platform, increasing confidentiality and compliance risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documented DELETE asset endpoint is destructive and the reference provides no caution about irreversible data loss or confirmation requirements. In an agent-driven workflow, a user or model could invoke deletion accidentally or through prompt manipulation, causing loss of uploaded media and derived artifacts.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Documenting a human re-identification capability materially expands the skill into biometric surveillance territory, which is more sensitive than ordinary video transcription or editing. In an agent setting, this can enable tracking individuals across videos without clear consent, policy gating, or user warning, creating significant privacy and compliance risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a skill for using the Memories.ai V2 API for transcripts, embeddings, AI analysis, and video operations. This file additionally documents operating a local webhook server, exposing callback/query/delete endpoints, and storing results under webhooks/results/<task_id>.json, which goes beyond merely calling the external API and introduces local service and persistence behavior not reflected in the manifest description.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest advertises broad Memories.ai V2 capabilities including embeddings, AI video/image analysis, and video editing operations. This file implements only four operations against transcript, MAI transcript, metadata, and comments endpoints, so the described functionality materially exceeds the actual behavior present here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The function posts a user-provided video URL to the Memories.ai backend, which transmits user-provided data over the network. The code performs the request silently with no confirmation prompt or user-facing notice about external data transmission beyond an internal docstring.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/memories_api.py (reported line 40)May include surrounding context.
python
if platform == "youtube": data["channel"] = "rapid" resp = requests.post(url, headers=HEADERS, json=data, timeout=30) return resp.json() DEFAULT_WEBHOOK = "https://demo.memories-ai.org/webhooks/memories/callback"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/memories_api.py (reported line 60)May include surrounding context.
python
if platform == "youtube": data["channel"] = "rapid" resp = requests.post(url, headers=HEADERS, json=data, timeout=30) return resp.json() DEFAULT_WEBHOOK = "https://demo.memories-ai.org/webhooks/memories/callback"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/memories_api.py (reported line 68)May include surrounding context.
python
if platform == "youtube": data["channel"] = "rapid" resp = requests.post(url, headers=HEADERS, json=data, timeout=30) return resp.json() DEFAULT_WEBHOOK = "https://demo.memories-ai.org/webhooks/memories/callback"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The async transcript function silently submits a callback URL to an external service and defaults to a preset webhook when the user provides none. This can cause task results or metadata to be delivered to an unexpected third-party endpoint, creating privacy and data-handling risks that are not obvious to the user.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 86% confidence
Finding: This async request includes a callback URL and can default to a preset webhook, causing external delivery of processing results or metadata to a destination the user may not expect. In the skill context, that makes the transmission more dangerous than ordinary API calls because it can redirect output to a third-party endpoint automatically.
Content: Scanner excerpt · scripts/memories_api.py (reported line 52)May include surrounding context.
python
# Use default webhook if not specified data["callback_url"] = callback_url or DEFAULT_WEBHOOK resp = requests.post(url, headers=HEADERS, json=data, timeout=30) return resp.json() def metadata(platform: str, video_id: str):

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The SDK exposes generic local file upload and arbitrary URL download capabilities that go beyond a narrowly scoped transcription/analysis wrapper and can be invoked on attacker-controlled paths or URLs. In an agent setting, this expands the skill from API access into local filesystem and outbound network I/O, increasing the risk of unintended file exfiltration, SSRF-style access to internal resources, or persistence of untrusted content.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: download_video fetches any supplied URL and writes the response to an arbitrary local path without URL validation, path restrictions, size limits, or content checks. In an agent environment this can be abused to access internal network endpoints or cloud metadata services and to overwrite or plant files locally if the caller can influence the URL or save path.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The method silently writes remote content to the local filesystem, which is a sensitive side effect not disclosed or gated by any confirmation mechanism. Even if intended for legitimate video handling, undisclosed file writes are dangerous in agentic contexts because they can store untrusted data, consume disk, or alter local state unexpectedly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The delete_asset method performs a destructive remote action by deleting an uploaded asset, but it provides no confirmation step, visible log, or warning beyond a terse docstring. Destructive or irreversible operations should include some form of disclosure so callers are clearly informed of the impact.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The function sends the supplied video ID to the remote Memories.ai service, but the script does not provide a user-facing warning that this identifier is transmitted off-system. For code files, network calls involving user or system data should have some visible disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The function posts the target video ID and comment limit to the remote API without any explicit user-facing disclosure. While expected for an API helper, the current script does not visibly warn the user that their requested target information is sent to an external backend.
Content: No source excerpt is available for this finding.