cortex-mem-mcp

• Outcome: Pass
• Latest audit: May 28, 2026 · 1:49 PM UTC
• Version: 2.7.0

Overview

This is a disclosed persistent-memory skill, but users should be careful about what it stores and which external services receive that data.

Before installing, verify the upstream cortex-mem-mcp package or release, use scoped provider API keys, keep config files out of repositories, restrict config permissions, avoid storing secrets or regulated data, and disable auto-triggering if you want explicit control over what gets saved.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill is explicitly designed to persist conversations, user preferences, and interaction history across sessions, but the documentation does not warn users about retention, sensitivity, consent, or privacy implications. In a memory-oriented skill, this omission is significant because operators may store personal or confidential data without understanding that it will be retained and made searchable over time.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The configuration examples place API keys directly in a plaintext config file without any warning about secret management or filesystem protections. This encourages insecure operational practices: keys may be committed to source control, exposed via backups, or read by other local users/processes if permissions are weak.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documented delete operation is destructive, yet the skill does not warn that deletion may be irreversible or that it can remove stored memory context relied upon by agents. In a persistent-memory system, accidental deletion can cause data loss, loss of auditability, and disruption of agent behavior.

External Transmission

Medium

• Category: Data Exfiltration

Content

[llm]
# LLM API configuration
api_base_url = "https://api.openai.com/v1"
api_key = "your-api-key"
model_efficient = "gpt-4o-mini"
temperature = 0.1

• Confidence: 92% confidence
• Finding: The skill config directs LLM traffic to an external API endpoint, which means stored or processed conversation content may leave the local environment. Given that this skill handles persistent memories and user preferences, external transmission materially increases privacy and compliance risk if users are not clearly informed and controls are not defined.

External Transmission

Medium

• Category: Data Exfiltration

Content

[embedding]
# Embedding configuration
api_base_url = "https://api.openai.com/v1"
api_key = "your-embedding-api-key"
model_name = "text-embedding-3-small"
batch_size = 10

• Confidence: 92% confidence
• Finding: The embedding configuration sends memory content or derived text to an external embedding API, creating another outbound data path for potentially sensitive persisted information. Because embeddings are generated from user conversations and preferences, this expands the exposure surface beyond local storage.

External Transmission

Medium

• Category: Data Exfiltration

Content

data_dir = "./cortex-data"

[llm]
api_base_url = "https://api.openai.com/v1"
api_key = "your-api-key"
model_efficient = "gpt-4o-mini"

• Confidence: 89% confidence
• Finding: This repeated configuration example again instructs use of an external LLM API without corresponding privacy guidance. In context, the danger is amplified because the skill's core function is to retain and retrieve cross-session memory, so externally processed data may include historical, aggregated, and potentially sensitive user context.

External Transmission

Medium

• Category: Data Exfiltration

Content

model_efficient = "gpt-4o-mini"

[embedding]
api_base_url = "https://api.openai.com/v1"
api_key = "your-api-key"
model_name = "text-embedding-3-small"

• Confidence: 89% confidence
• Finding: This embedding example repeats the external transmission risk for persisted memory content and indexing data. In a memory skill, even seemingly routine embedding calls can expose a broad corpus of retained user information if indexing is applied indiscriminately.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Configuration

### Step 1: Create Configuration File

Create a `config.toml` file (e.g., `~/.config/cortex-mem/config.toml`):

• Confidence: 95% confidence
• Finding: The skill intentionally creates persistent local storage for cross-session memory, which is core functionality rather than an accidental behavior. However, persistence of conversations and preferences is still security-relevant: it increases exposure from local compromise, backups, shared machines, and unauthorized access if storage protections, retention limits, and user awareness are absent.

Static analysis

No suspicious patterns detected.