other
Warning
- Location
- SKILL.md:118
- Finding
- Automatic Persistent Capture and Cross-Session Reuse of Conversation Data## Vulnerability Details **File Location**: `SKILL.md`, lines 52-72, 118-132, and 136-145 **Vulnerability Type**: `other: Unconsented Persistent Conversation Data Collection` **Risk Level**: Medium ### Relevant Skill Instructions The following is an English rendering of the complete relevant source segments: ```markdown | Tool | Purpose | When to use | |------|---------|-------------| | `nmem_remember` | Store memories | After decisions, errors, facts, insights, or user preferences | | `nmem_recall` | Query memories | Before tasks, when users reference previous context, or ask "Do you remember..." | | `nmem_context` | Obtain recent memories | At session start and when injecting fresh context | | `nmem_todo` | Quick TODO with 30-day expiration | Task tracking | | Tool | Purpose | When to use | |------|---------|-------------| | `nmem_auto` | Automatically extract memories from text | After important conversations; automatically capture decisions, errors, and TODOs | | Tool | Purpose | When to use | |------|---------|-------------| | `nmem_transplant` | Transfer memories between brains | Cross-project knowledge sharing | ``` ```markdown ## Workflow ### At session start 1. Call `nmem_context` to inject recent memories into awareness. 2. If the user mentions a specific topic, call `nmem_recall`. ### During the conversation 3. When a decision is made: call `nmem_remember` with `type="decision"`. 4. When an error occurs: call `nmem_remember` with `type="error"`. 5. When the user states a preference: call `nmem_remember` with `type="preference"`. 6. When asked about past events: call `nmem_recall`. ### At session end 7. Call `nmem_auto` with `action="process"` to process important conversation excerpts. 8. Automatically extract facts, decisions, errors, and TODOs. ``` ```markdown | Parameter | Type | Range | Default | Description | |-----------|------|-------|---------|-------------| | ...[truncated 2560 chars]
- Remediation
- ## Remediation Suggestions 1. Set `autoCapture` and `autoContext` to `false` by default and require explicit, informed opt-in. 2. Present the exact content proposed for storage and obtain confirmation before persisting it. 3. Detect and redact passwords, API keys, authentication tokens, financial data, personal identifiers, and other sensitive material. 4. Isolate memory by authenticated user, tenant, session, and project using deny-by-default access controls. 5. Require separate confirmation and authorization before `nmem_transplant` transfers any memory across project boundaries. 6. Encrypt memory data in transit and at rest, and avoid recording secrets in logs or diagnostic output. 7. Add configurable retention periods, automatic expiration, searchable deletion, export, and complete revocation controls. 8. Record provenance, creation time, owner, intended scope, and expiration for every memory. 9. Treat recalled memories as untrusted contextual data. Never interpret recalled instructions as higher-priority Agent or system instructions. 10. Require confirmation before recalled data is exposed to another user, project, external tool, or model. 11. Document the storage location, threat model, authorization rules, and privacy guarantees. 12. Add tests covering tenant isolation, deletion, secret redaction, malicious stored instructions, and unauthorized cross-project transfer.