Security audit
Security checks for vulnerabilities and agentic risk
The skill behaves like a disclosed local memory manager and I found no hidden network access, privilege escalation, or deceptive behavior.
Install only if you want a local agent-memory database that can be updated, pruned, and archived. Keep the database and archive paths pointed at intended files, review records before archiving them into files that agents may load later, and do not store untrusted instructions or sensitive data unless you are comfortable with them reappearing in future agent context.
scripts/ebbinghaus.py:149Persistent Untrusted Memory Content Can Poison Future Agent Context
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
| Status | Strength | Meaning |
|--------|----------|---------|
| 🟢 Active | ≥ 0.7 | Recently used, clear memory |
| 🟡 Decaying | 0.3–0.7 | Not used for a while |
| 🔴 Fading | < 0.3 | Needs review or cleanup |
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Heartbeat output rules:
- 🔴 items exist → alert user, ask "review or forget?"
- Only 🟡 items → log silently, no interruption
- All 🟢 → output `HEARTBEAT_OK`
The skill instructs users to run a local script that reads environment variables and creates, modifies, appends to, and deletes local files, but it declares no explicit tool scope or permissions. That mismatch increases the chance an agent or user will invoke file-destructive behavior without clear authorization boundaries or safety review.
The trigger phrases include broad terms like "memory management," "clean up memory," and "review memory," which could match many unrelated requests. In an agent setting, overbroad activation can cause this skill to run in contexts where file mutation or deletion was not intended.
The documentation explains that the script auto-creates a database file and can archive or delete memory records, but it does not present an upfront warning that local files will be created and modified. Users or agents may therefore treat the skill as informational when it actually performs persistent filesystem changes.
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
def save_db(db):
db_path = os.path.abspath(DB_PATH)
os.makedirs(os.path.dirname(db_path), exist_ok=True)
with open(db_path, "w", encoding="utf-8") as f:
json.dump(db, f, ensure_ascii=False, indent=2)
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
category = item.get("category", "general")
archive_path = os.path.abspath(ARCHIVE_PATH)
os.makedirs(os.path.dirname(archive_path), exist_ok=True)
with open(archive_path, "a", encoding="utf-8") as f:
f.write(f"\n### [Archived] {content}\n")
if source:
f.write(f"- Source: {source}\n")
No suspicious patterns detected.