Security audit
Security checks for vulnerabilities and agentic risk
This is a local memory tool, but it encourages automatic plaintext storage of conversation-derived information without enough consent, retention, or source-control protections.
Install only if you want project-local persistent memory. Pin the package version, add SESSION-STATE.json, MEMORY.md, and memories/*.json to the project .gitignore, do not store secrets or regulated personal data, periodically review/delete memory files, and treat memory-list --date as unsafe with untrusted input until date validation is fixed.
lib/memory-core.js:216Path Traversal Permits Reading JSON Files Outside the Memory Directory
bin/memory-init.js:40Sensitive Agent Memory Is Stored in Plaintext and Is Not Ignored by Default
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
memory-export --format json --output monthly-backup.json
rm memories/2026-02-*.json # Example: remove Feb logs
## Comparison with elite-longterm-memory
The code is consistent with part of the description in that it is zero-dependency, uses no API keys, and operates purely on local files. However, the supplied code chunk does not implement a memory system with smart search; it only initializes local template files and directories. The declared description presents a broader functional capability than the code actually provides, making this a description-behavior mismatch for this chunk.
The README recommends running the package via npx simple-local-memory without pinning a specific version. That causes users or agents to fetch and execute whatever package version is current at invocation time, increasing supply-chain risk if a malicious or compromised release is published later.
These agent instructions tell the assistant to write user-provided information such as preferences and context to local files, but they do not clearly warn that conversation content will be persisted to disk. In an agent setting, this can lead to silent retention of sensitive or regulated data that the user may not expect to be stored.
The natural-language instructions direct agents to capture user-shared information into persistent memory files as part of standard workflow. In practice this creates a data retention and leakage risk because users may reveal personal, proprietary, or otherwise sensitive information during normal conversation that is then stored for later access.
Maintaining context across sessions is the advertised feature, but in a security review this means user information persists beyond the current interaction and can be re-surfaced later. That persistence becomes risky when combined with vague storage criteria and no clear consent, retention, or access-control guidance.
When user expresses preferences or decisions:
1. Document in SESSION-STATE.json
2. Store using: memory-store --type preference --content "..."
3. Maintain context across sessions
Memory commands available:
- memory-store: Save information
The WAL protocol says to save memory before responding for broad categories like preferences, corrections, and deadlines, but it does not include any warning or consent requirement around automatic persistence. This encourages default collection of user data and makes accidental over-retention more likely in normal agent interactions.
The WAL table normalizes saving inputs like corrections and deadlines before every response, which promotes broad retention of conversational content without evaluating necessity or sensitivity. That increases the chance that private or business-sensitive details are written into files and later exposed through local compromise, backups, or accidental sharing.
The skill instructs the agent to automatically persist user information and preferences to local storage without consent flow, retention limits, or warnings about sensitive data. This creates a privacy risk because users may disclose confidential or regulated information that is silently retained on disk and later exposed to other local users, processes, backups, or prompts.
These instructions normalize saving user-provided context and preferences by default, which can lead to over-collection of conversational data in natural-language workflows. In the context of an AI memory skill, that increases the chance of retaining credentials, personal data, business secrets, or other sensitive content that was never meant for durable storage.
The write-ahead logging workflow tells the agent to save user statements before responding, encouraging comprehensive retention prior to any safety, consent, or sensitivity checks. That makes the skill more dangerous in context because it operationalizes automatic capture of potentially sensitive conversation data as a mandatory first step.
The library persists arbitrary memory content, tags, and context to local JSON files on disk, but there is no built-in disclosure, consent flow, or retention control in this code path. Because this skill is explicitly marketed as a memory system and may receive sensitive prompts, private user data can be stored unexpectedly and later exposed to other local users, backups, logs, or forensic access.
Session state is written to SESSION-STATE.json without any user-facing notice or consent mechanism, which can silently persist task context, pending actions, and decision history. In an agent setting, session state often contains sensitive operational or personal information, so undisclosed local persistence creates a meaningful privacy and confidentiality risk.
Detected: suspicious.prompt_injection_instructions