Memory System V2 1.0.0

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:36 AM UTC
• Version: 1.0.0

Overview

This is a coherent local memory skill, but it persists and recalls potentially sensitive agent/user history without enough scoping, safety boundaries, or retention controls.

Review this before installing if you handle private, regulated, client, or credential-bearing information. Do not store secrets or raw sensitive conversations as memories, treat recalled memories as untrusted notes, and consider adding redaction, deletion/retention controls, strict file permissions, and safer JSON construction before relying on it.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: memory-cli.sh:38

Finding

Persistent Agent Memory Poisoning Through Untrusted Stored Content

Content

View full analysis

> "$daily_file" echo "## [$timestamp] $type (importance: $importance)" >> "$daily_file" echo "$content" >> "$daily_file" if [[ -n "$context" ]]; then echo "**Context:** $context" >> "$daily_file" fi if [[ -n "$tags" ]]; then echo "**Tags:** $tags" >> "$daily_file" fi echo "" >> "$daily_file" # Get line number local line=$(wc -l < "$daily_file") # Create memory entry local memory_entry=$(cat <

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: memory-cli.sh:58

Finding

Unsafe JSON Construction Allows Index Injection and Corruption

Content

View full analysis

"$temp_index" mv "$temp_index" "$INDEX_DIR/memory-index.json" ``` ### Technical Analysis The values of `type`, `importance`, `content`, and `context` are interpolated directly into a JSON document. Only `tags` is encoded through `jq`. Inputs containing quotation marks, backslashes, newlines, commas, or JSON object syntax can terminate an intended value and introduce additional properties, produce duplicate properties, change field types, or make the entire document invalid. The `importance` field is particularly exposed because it is inserted without quotes and is not validated as an integer from 1 through 10. For example, a crafted value containing a number followed by additional JSON properties can alter the generated object if the resulting document remains valid. Malformed input also creates an integrity issue because the daily Markdown file is modified before `jq --argjson` validates the generated entry. If index generation fails, the daily file contains a memory that is absent from the index. The script does not use `set -e`, verify the success of `jq`, or conditionally execute `mv`, so failures can produce misleading success behavior or overwrite the index with invalid or empty output under some error conditions. ...[truncated 1550 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: memory-cli.sh:4

Finding

Sensitive Persistent Memories May Be Created with Overly Permissive Filesystem Modes

Content

View full analysis

"$INDEX_DIR/memory-index.json" fi ``` ```bash # Append to daily log echo "" >> "$daily_file" echo "## [$timestamp] $type (importance: $importance)" >> "$daily_file" echo "$content" >> "$daily_file" if [[ -n "$context" ]]; then echo "**Context:** $context" >> "$daily_file" fi if [[ -n "$tags" ]]; then echo "**Tags:** $tags" >> "$daily_file" fi echo "" >> "$daily_file" ``` ### Technical Analysis The Skill is designed to store interactions, decisions, preferences, events, and task context. Such records can contain personally sensitive or confidential information. The script creates its directories and files using the process's ambient `umask` and does not enforce owner-only permissions. On systems configured with a permissive `umask`, the index, daily logs, or consolidated summaries may be readable by other local accounts or processes. The exact exposure depends on the host's existing directory permissions and `umask`, so this is a conditional local confidentiality risk rather than guaranteed public disclosure. The chosen storage location under the current user's home directory is appropriate for the declared local-memory functionality and does not exceed the required filesystem scope. The deficiency is the absence of expl ...[truncated 1086 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code generally aligns with the broad idea of a persistent memory system: it captures memories, stores them locally, indexes them in JSON, retrieves recent items, shows stats, and can consolidate weekly summaries. However, key advertised capabilities are overstated or inaccurate. There is no semantic search; search is implemented as a simple jq 'contains' substring match on content. The '<20ms search' performance claim is not substantiated by the code. 'Auto-consolidation' is also inaccurate because consolidation only occurs through a manual CLI command rather than automatically. These are material description-to-behavior mismatches, even though the overall domain/purpose is related.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

md

./memory-cli.sh capture \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.

md

./memory-cli.sh capture \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.

md

./memory-cli.sh capture \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 212)May include surrounding context.

md

./memory-cli.sh capture \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 217)May include surrounding context.

md

./memory-cli.sh capture \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 240)May include surrounding context.

md

./memory-cli.sh capture \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 250)May include surrounding context.

md

./memory-cli.sh capture \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 260)May include surrounding context.

md

./memory-cli.sh capture \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.

md

./memory-cli.sh capture \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 278)May include surrounding context.

md

./memory-cli.sh capture \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 281)May include surrounding context.

md

./memory-cli.sh capture \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 287)May include surrounding context.

md

./memory-cli.sh capture \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 293)May include surrounding context.

md

./memory-cli.sh capture \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 328)May include surrounding context.

md

./memory-cli.sh capture \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is explicitly designed to persist memories, decisions, interactions, and prior work across sessions, but it does not warn users that potentially sensitive content may be written to local files. In an agent setting, this can lead to unintentional storage of secrets, personal data, internal discussions, or regulated information that later becomes discoverable or exposed.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Encouraging routine capture and recall of prior interactions across sessions creates a real data-retention risk in natural language form. The danger is contextual here because the skill is purpose-built for persistent memory, so absent safeguards it normalizes storing potentially sensitive user content that may later be surfaced to the wrong prompt, user, or workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documented consolidation feature creates additional persisted summary files, which can amplify data retention by copying sensitive material into new locations and making it easier to retrieve in aggregate. Without a warning, users may not realize that summaries can preserve and broaden exposure of information beyond the original daily logs.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly instructs the agent to store user requests and key conversations as memory, which materially increases the chance that sensitive personal, business, or security-relevant information will be retained verbatim. Once normalized into memory, that content may be searchable and reusable in later contexts where disclosure is inappropriate or unintended.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The AGENTS.md integration tells the agent to consult memory before answering about people, preferences, todos, and prior work, which increases the likelihood of resurfacing retained private information in future responses. In this context, the memory system becomes an implicit secondary data source that may bypass user expectations about confidentiality and temporal scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The automatic consolidation and archiving workflow describes modifying, summarizing, and moving stored data without any safeguards, review step, or warning to the user. In a memory system, silent transformation of records can cause loss of fidelity, accidental retention of sensitive data in derived summaries, or unintended persistence of information the user expected to remain temporary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The design explicitly targets 100% capture of daily activities but does not mention consent, data minimization, retention limits, or handling of sensitive information. In a persistent cross-session memory skill, this can lead to over-collection of personal, confidential, or regulated data and make later leakage or misuse more damaging.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The capture function persistently stores arbitrary user-provided content, context, and tags into files under the user's home directory with no notice, consent flow, redaction, or sensitivity checks. In a memory skill whose purpose is long-term retention across sessions, this increases the chance that secrets, personal data, or confidential work context are stored and later exposed through local access, backups, or subsequent retrieval commands.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The weekly consolidation routine creates additional persistent summary artifacts containing previously stored memory content, which broadens the footprint of sensitive data and duplicates it into another location. Even though this behavior is aligned with the feature's purpose, the lack of warning or control can surprise users and increase unintended retention and disclosure risk through extra files, syncing, or backups.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.