Cognee Memory System

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:27 AM UTC
• Version: 1.0.0

Overview

This memory skill matches its stated purpose, but it asks users to install external packages and describes automatic persistent capture of prompts, tool actions, and session context without enough scoping or privacy controls.

Review this before installing in any workspace with secrets, customer data, regulated data, or sensitive tool outputs. Use isolated test credentials, understand where Cognee stores memory, avoid storing secrets, confirm deletion behavior before using bulk forget commands, and treat recalled memory as untrusted context rather than instructions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:13 and SKILL.md:115-117
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

text

**Installation:** `pip install cognee`

bash

npm install @cognee/cognee-openclaw

Technical Analysis

The documented Python and npm installation commands do not specify exact package versions, lockfiles, integrity hashes, or artifact-signature verification. As a result, executing these commands at different times may install materially different code from the code that was originally reviewed.

Package installation can execute build hooks, lifecycle scripts, imported initialization code, and transitive dependencies. A compromised package-maintainer account, registry compromise, or malicious transitive dependency could therefore introduce executable code into the agent environment without any modification to this Skill file.

The file does not itself contain a malicious dependency or demonstrate that either named package is compromised. The vulnerability is the unsafe, mutable dependency-installation process.

Attack Path

1. An attacker compromises an upstream package, its maintainer account, or one of its transitive dependencies.
2. The attacker publishes a malicious release under the package version range selected by default.
3. A user follows the documented unpinned pip install cognee or npm install @cognee/cognee-openclaw command.
4. The package manager retrieves the newly published, unreviewed release.
5. Malicious code executes through installation hooks, package initialization, or subsequent plugin use with the privileges of the installing or agent process.

Impact Assessment

Successfully exploited dependency compromise could execute arbitrary code with the privileges of the account running pip, npm, or the agent. Depending on those privileges, the malicious dependency could access agent conf ...[truncated 186 chars]

Remediation

View remediation

Remediation Suggestions

• Pin each direct dependency to an exact, reviewed version.
• Provide reproducible lockfiles containing resolved transitive dependency versions.
• Verify downloaded artifacts with trusted hashes or cryptographic signatures.
• Use an explicitly configured trusted package registry and prevent dependency fallback to untrusted sources.
• Review package provenance, maintainers, release history, and transitive dependencies before installation.
• Disable npm lifecycle scripts during installation where they are unnecessary, then explicitly permit only reviewed build steps.
• Install dependencies inside an isolated, least-privileged virtual environment or container.
• Continuously scan locked dependencies for known vulnerabilities and review every dependency update before deployment.

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:119

Finding

Automatic Persistent Memory Capture Enables Cross-Session Memory Poisoning

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:119-124
Vulnerability Type: Persistent storage and reinjection of potentially untrusted agent context
Risk Level: Medium

Vulnerable Code

text

The plugin automatically integrates:
- `SessionStart` → initialize memory
- `PostToolUse` → capture actions
- `UserPromptSubmit` → inject relevant context
- `PreCompact` → preserve memory across contexts
- `SessionEnd` → bridge to the permanent knowledge graph

The documented API also demonstrates storing session information:

python

await cognee.remember("User prefers detailed explanations.", session_id="chat_1")

Technical Analysis

The documented plugin workflow captures agent actions, preserves memory across context compaction, transfers information into a permanent knowledge graph, and later injects retrieved content when a user prompt is submitted. This creates a persistent trust boundary between content observed in one interaction and instructions or decisions made in later interactions.

The Skill does not document controls for user consent, provenance tracking, content trust levels, credential redaction, tenant isolation, retention limits, or validation of recalled data before it is placed into the agent context. It also does not specify that recalled text must be treated only as untrusted reference data and must never override system or developer instructions.

Consequently, attacker-controlled prompt content or attacker-influenced tool output may be retained and later reintroduced into another context. If the consuming agent interprets instruction-like memory as authoritative guidance, the stored content can influence future behavior beyond the session in which it was introduced.

Attack Path

1. An attacker submits a prompt, document, or other tool-visible content containing misleading facts or instruction-like text.
2. The plugin observes the content or related action through ...[truncated 1158 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit opt-in before prompts, tool outputs, or actions are persisted.
• Treat all recalled memory as untrusted data, never as system or developer instructions.
• Place recalled content in a clearly delimited data structure and prevent it from changing instruction priority.
• Apply secret, credential, personal-data, and prompt-injection filtering before storage and again before retrieval.
• Record provenance, creator identity, source session, timestamp, confidence, and trust level for every memory item.
• Enforce strict user, session, workspace, and tenant access boundaries.
• Require review or confirmation before persisting instruction-like content or using recalled content for sensitive tool operations.
• Add configurable retention periods, expiration, inspection, correction, and reliable deletion mechanisms.
• Restrict automatic capture to an explicit allowlist of low-risk fields rather than retaining complete prompts or tool outputs.
• Test the retrieval pipeline against stored prompt injection, cross-session poisoning, and cross-tenant disclosure scenarios.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The plugin description states that user prompts, tool actions, session state, and context are automatically captured and bridged into persistent memory, but it provides no privacy warning, consent model, filtering guidance, or data minimization controls. In an agent environment, this can silently persist sensitive prompts, secrets, internal tool outputs, and behavioral traces, substantially increasing privacy and data-exposure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly presents persistent storage and deletion operations as core functionality, but gives no warning that remembered data may be retained beyond the current session or that deletion may be irreversible. In a memory system skill, omission of retention/destruction caveats can cause accidental storage of sensitive user data and unintended data loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The CLI examples include cognee-cli forget --all, which is an explicitly destructive command, yet the documentation provides no caution, confirmation behavior, or recovery guidance. Users may copy-paste the example and erase all stored memory unintentionally, making this a real safety issue even if not a code-execution vulnerability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The environment setup instructs users to export LLM and service API keys and references external providers, but does not warn that these credentials are sensitive or that prompts and stored memory may be transmitted to third-party services. This increases the risk of credential mishandling and unintentional disclosure of user data to external systems.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.