cortex-mem-mcp

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:24 AM UTC
• Version: 2.7.0

Overview

This is a coherent persistent-memory skill, but users should understand that it stores conversation-derived data and may send it to configured LLM and embedding providers.

Install only if you are comfortable running the external MCP server and Qdrant, storing cross-session memories locally, and sending memory-related text to the configured LLM and embedding providers. Use pinned versions where possible, restrict config-file permissions, keep API keys out of repositories, avoid storing secrets or regulated personal data, and disable auto-triggering if memories should only be created on explicit request.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:26

Finding

Unpinned and Unverified Third-Party Executable Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 26-51
Vulnerability Type: Supply-chain exposure through mutable, unverified dependencies
Risk Level: Medium

Vulnerable Code Snippet

bash

cargo install cortex-mem-mcp

bash

# Clone the repository
git clone https://github.com/sopaco/cortex-mem.git
cd cortex-mem

# Build the release binary
cargo build --release --bin cortex-mem-mcp

# The binary will be at:
# ./target/release/cortex-mem-mcp (Linux/macOS)
# .\target\release\cortex-mem-mcp.exe (Windows)

The instructions also direct users to download the latest release:

text

Download the latest release from GitHub:

- **GitHub Releases**: https://github.com/sopaco/cortex-mem/releases

A related mutable container dependency appears at SKILL.md, line 93:

bash

docker run -d -p 6333:6333 qdrant/qdrant

Technical Analysis

The installation instructions retrieve and execute third-party software using mutable references:

• cargo install cortex-mem-mcp does not specify an exact crate version.
• The Git repository is cloned without checking out a fixed commit or verified signed tag.
• Users are directed to the “latest” GitHub release without signature or checksum verification.
• The Qdrant container uses an unversioned image tag and no immutable image digest.

The reviewed skill package contains no executable scripts of its own, and there is no evidence that the named upstream projects are malicious. The issue is that the effective code executed by users can change after this skill has been reviewed. Artifact integrity and reproducibility therefore depend entirely on the current state of external registries and repositories.

Attack Path

1. An attacker compromises an upstream package registry account, source repository, release process, container registry, or maintainer credential.
2. The attacker publishes a malicious crate version, repository revision, release binary, or container image under the expected ...[truncated 1140 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the Cargo installation to a reviewed exact version:

   bash

   cargo install cortex-mem-mcp --version '<exact-reviewed-version>' --locked
   

2. Pin source builds to a reviewed commit hash or signed release tag:

   bash

   git clone https://github.com/sopaco/cortex-mem.git
   cd cortex-mem
   git checkout '<reviewed-commit-sha>'
   

3. Publish expected SHA-256 or stronger hashes for all prebuilt binaries and require verification before execution.

4. Prefer cryptographically signed releases and document signature verification using a trusted maintainer key.

5. Pin the Qdrant image to a reviewed version and immutable digest:

   bash

   docker run -d -p 127.0.0.1:6333:6333 \
     qdrant/qdrant:<version>@sha256:<verified-digest>
   

6. Record reviewed versions and hashes in the skill so installations remain reproducible after upstream releases change.

7. Run the MCP server and Qdrant with least privilege, isolated service accounts, restricted filesystem access, and limited outbound network access.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:64

Finding

API Credentials Stored in Plaintext Configuration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 64-76
Vulnerability Type: Plaintext sensitive-data storage
Risk Level: Medium

Vulnerable Code Snippet

toml

[llm]
# LLM API configuration
api_base_url = "https://api.openai.com/v1"
api_key = "your-api-key"
model_efficient = "gpt-4o-mini"
temperature = 0.1
max_tokens = 65536

[embedding]
# Embedding configuration
api_base_url = "https://api.openai.com/v1"
api_key = "your-embedding-api-key"
model_name = "text-embedding-3-small"
batch_size = 10
timeout_secs = 30

The same plaintext-key pattern is repeated in the example at SKILL.md, lines 400-410.

Technical Analysis

The documentation instructs users to replace placeholder values with API credentials in a persistent TOML configuration file. It does not instruct users to apply owner-only permissions, exclude the file from source control and backups, or retrieve credentials from environment variables or an operating-system secret store.

Although the sample does not contain real credentials, users following it are likely to create a plaintext file containing active secrets. Any process or local account capable of reading that file can recover the keys. The exposure risk increases if the configuration is placed inside a project directory, synchronized to cloud storage, included in backups, attached to support requests, or accidentally committed to a repository.

This is not evidence of intentional credential theft. It is insecure credential-handling guidance that can make compromise easier after a local disclosure, repository leak, or overly broad file-permission condition.

Attack Path

1. A user copies the provided configuration and replaces the placeholders with valid LLM and embedding API keys.
2. The resulting config.toml is created with overly broad read permissions, copied into a repository, synchronized, backed up, or exposed to another local process.
3. An attacker obtains read access through a repository leak, sha ...[truncated 863 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer environment-variable references or an operating-system secret manager instead of literal keys in config.toml.

2. If the application requires a plaintext configuration file, instruct users to restrict access immediately:

   bash

   chmod 600 ~/.config/cortex-mem/config.toml
   

3. Store the configuration outside source-controlled project directories.

4. Add config.toml, .env, and equivalent secret-bearing files to .gitignore, while retaining a sanitized config.example.toml.

5. Document secure secret injection for each supported MCP client and deployment environment.

6. Use separate, least-privilege keys for LLM and embedding services. Apply provider-side spending limits, usage alerts, expiration, and rotation policies.

7. Ensure debug logging does not print configuration contents, request authorization headers, or API keys.

8. Add explicit guidance to revoke and rotate credentials immediately if a configuration file is committed, shared, or otherwise exposed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The top-level description advertises persistence of conversations and user preferences but does not clearly warn that this data may be sent to external LLM and embedding APIs. That omission can cause operators or end users to enable the skill without informed consent about cross-session retention and third-party processing.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

The skill instructs users to create a persistent local data directory for memories, enabling cross-session retention by design. In a memory skill this is expected functionality, but without strong warnings, retention controls, and secure-storage guidance, it creates a real privacy and data-exposure risk.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

## Configuration

### Step 1: Create Configuration File

Create a `config.toml` file (e.g., `~/.config/cortex-mem/config.toml`):

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The configuration points LLM traffic to https://api.openai.com/v1, meaning stored or processed conversation content may be transmitted to an external service. In a persistent memory skill, this materially increases privacy and data-governance risk because retained cross-session context can include sensitive information.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md

[llm]
# LLM API configuration
api_base_url = "https://api.openai.com/v1"
api_key = "your-api-key"
model_efficient = "gpt-4o-mini"
temperature = 0.1

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The embedding configuration sends memory content to an external embedding API, which is another third-party transmission path for potentially sensitive text. Since embeddings are generated from persistent memories, users need clear notice and controls over what content leaves the local environment.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md

[embedding]
# Embedding configuration
api_base_url = "https://api.openai.com/v1"
api_key = "your-embedding-api-key"
model_name = "text-embedding-3-small"
batch_size = 10

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The documentation runs the qdrant/qdrant Docker image without a fixed tag or digest, so users may pull a changed or malicious image unexpectedly. In a skill that stores persistent conversation memory, compromise of the backing vector database could expose or tamper with sensitive retained data.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly promotes persistent collection and later recall of user preferences, conversation context, interaction history, and project knowledge across sessions. In this context, the risk is not the feature alone but the lack of strong privacy boundaries, minimization guidance, and warnings against storing sensitive data verbatim.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The examples encourage storing raw conversation content and retrieving full-content memories, which can reproduce sensitive or personal data verbatim. Because this skill is specifically designed for persistent recall, unsafe examples increase the chance of users operationalizing privacy-invasive patterns.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill documents a delete capability for memories but gives no caution about irreversibility, scope validation, or confirmation flow. In a persistent memory system, accidental or adversarial deletion can destroy retained context, preferences, or project knowledge.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

A second configuration example repeats external LLM transmission without prominent warning, reinforcing a risky default deployment pattern. Repetition of unsafe-default examples in documentation increases the likelihood that users will adopt them without considering privacy implications.

Content

Scanner excerpt · SKILL.md (reported line 440)May include surrounding context.

md

data_dir = "./cortex-data"

[llm]
api_base_url = "https://api.openai.com/v1"
api_key = "your-api-key"
model_efficient = "gpt-4o-mini"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The repeated external embedding API example again normalizes sending retained memory content to third-party infrastructure. Given the skill's purpose of long-term recall, this expands the exposure surface for user data beyond the local machine and vector store.

Content

Scanner excerpt · SKILL.md (reported line 445)May include surrounding context.

md

model_efficient = "gpt-4o-mini"

[embedding]
api_base_url = "https://api.openai.com/v1"
api_key = "your-api-key"
model_name = "text-embedding-3-small"

Static analysis

No suspicious patterns detected.