Security audit

Neural Memory CN

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real neural-memory skill, but it needs review because it can persist sensitive personal memory and may send queries or memory text to external AI providers without strong user-facing controls.

Review before installing. Use local-only mode unless you intentionally want a third-party LLM provider involved, and avoid running it in an environment with OPENROUTER_API_KEY or OPENAI_API_KEY unless you are comfortable sending queries or memory-derived text to that provider. Do not store highly sensitive profile, preference, or proprietary content unless you are prepared for it to persist in local plaintext files and to manage deletion manually.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documentation demonstrates capabilities that read environment variables, modify files under the user's home directory, and optionally send data to a remote LLM API, but the metadata declares no corresponding permissions. This creates a transparency and consent problem: users may install or run the skill without realizing it can access local configuration/data and transmit memory queries to the network.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The adapter fabricates memory-reference style results by mapping neurons to pseudo file paths and placing content snippets into the 'lines' field instead of real line references. This can mislead downstream consumers into treating synthesized associations as authoritative memory hits, causing data provenance confusion and potentially exposing long-term memory content in contexts that expect only references.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: This code sends raw user queries to an external LLM endpoint, which can expose sensitive user inputs to a third party. In a memory system, queries may contain personal or confidential context, so remote transmission materially changes the privacy boundary even if the feature is intended.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The LLM setup instructions tell users to configure a third-party API endpoint and then use the memory system for intent analysis, but they do not warn that user queries and potentially stored knowledge content may be transmitted off-device. In a memory-oriented skill, this omission is more sensitive than usual because prompts may include personal notes, proprietary knowledge, or other confidential data.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The API reference exposes remote LLM configuration fields, including llm_base_url and llm_api_key, without warning that user queries and learned content may be transmitted to an external service when LLM-backed analysis is enabled. In a memory system, that content can include sensitive personal or proprietary data, so omission of this disclosure creates a real privacy and data-handling risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The setup script reads the LLM API key from environment variables or CLI arguments and persists it into config.yaml/config.json on disk. This creates a credential-at-rest risk because the file may have broader filesystem exposure, be backed up, committed, or read by other local users or processes without the operator realizing the secret was stored permanently.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README explicitly says the heartbeat workflow will record thinking results into long-term memory, but it does not present clear notice, consent, retention limits, or user controls around this persistence. In a memory system that may process sensitive user content, silent automatic retention can expose private data, create compliance risk, and surprise users or integrators.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation describes storing protected personal attributes and daily activation query history, which can reveal identity, preferences, and behavior over time, without an explicit privacy warning or disclosure safeguards. Even if framed as a feature, retaining this data by default increases the risk of privacy leakage, profiling, and unauthorized access to sensitive memory contents.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The external transmission point lacks any in-function consent check, warning, or policy enforcement before user text is sent to a remote provider. That creates a privacy and transparency issue, especially in a tool marketed primarily as a local memory system where users may reasonably expect queries to stay local.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The engine sends raw text to a remote embedding provider via `client.embeddings.create(...)` when API credentials are present, but the code provides no consent flow, redaction, policy gate, or user-visible disclosure before transmitting potentially sensitive memory content. In a memory system, stored notes, neuron content, and queries may contain personal, confidential, or proprietary data, so silent external transmission creates a real privacy and data-governance risk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The builder automatically reads sensitive long-term memory files such as user profile and preferences, extracts their contents, and persists derived neuron records without any explicit consent, notice, or scope restriction in this code path. In a memory/agent skill, this increases the risk of over-collection and unintended secondary use of personal data, especially if downstream components later expose or transmit the neuron store to other features or LLM-backed functionality.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The decay logic automatically deletes synapses when their weight drops below a threshold, with only aggregate logging and no confirmation, audit trail, or recovery path. In a memory system, this can silently destroy stored relationships and may be triggered as part of routine execution, creating integrity and availability risks for user data.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This pruning routine deletes low-confidence synapses directly from storage without prior warning or a safety mechanism. Because confidence can be noisy or model-derived, legitimate memory links may be removed unexpectedly, causing silent data loss and making the system's behavior hard to verify or recover from.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: This learning path updates or creates memory records and connections in persistent storage without any explicit user consent or clear notice at the point of use. In a memory-oriented skill, silent persistence can cause sensitive user content to be retained unexpectedly, increasing privacy and data retention risk, especially if users assume queries are ephemeral.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The maintenance/save workflow performs persistent writes to disk via save_all() without any upfront disclosure, which can retain or modify user-derived memory data outside the user's expectations. In a system designed to ingest and recall potentially sensitive text, undisclosed persistence and background maintenance materially increase privacy risk even if the behavior is not overtly malicious.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The manager writes potentially sensitive long-term memory data, including protected user-profile and preference-related entries, to disk in plaintext JSON without any access-control, encryption, consent, or notice mechanisms visible in this component. On shared systems or compromised user accounts, these files could be read or copied, exposing intimate memory contents and behavioral data.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: Activation records are persisted in plaintext JSON files under a local storage path without any consent prompt, disclosure, minimization, or protection controls. In a memory system, activation logs can reveal user interests, prompts, associations, and behavior patterns, so local disk storage creates a privacy and data exposure risk if the host is shared, compromised, or backed up to less trusted locations.

Ssd 3

Medium

Confidence: 84% confidence
Finding: The README states that user identity, preferences, personality, and related core attributes are protected from deletion or decay, implying persistent retention of sensitive profile data without documenting disclosure limits or safeguards. This makes the skill context more dangerous because it is explicitly a long-term memory system, so persistent sensitive-data accumulation is central to operation and may outlive user expectations.

Ssd 3

Medium

Confidence: 92% confidence
Finding: The heartbeat workflow records thinking results to long-term memory, and the storage design logs daily activation queries for analysis, creating a durable trail of user interactions and inferred associations. In a cognitive-memory skill, these logs can expose sensitive intent, interests, and behavioral patterns if accessed improperly or retained too broadly.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.