Security audit

Hermesclawzero Auto Memory

Security checks across malware telemetry and agentic risk

Overview

This is a local memory skill, but it enables broad automatic conversation retention and silent reuse of stored context without enough user controls or scoping.

Install only if you intentionally want default-on long-term memory. Review the local Sidecar scripts before use, especially daily_reminder.py, and avoid sharing secrets or sensitive personal data while the skill is active unless you have clear retention, deletion, and notification controls.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The manifest-level description understates the skill’s behavior by omitting that it can configure a daily Telegram/reminder push job. This creates a transparency gap: users or operators may enable the skill expecting local memory only, while it also provisions recurring outbound notification behavior, which affects consent, review, and deployment risk.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The privacy section claims the skill stores only meaningful facts and not raw chat logs, but later instructions define a full chat-history backup workflow to persistent storage. This is dangerous because it can mislead users about the scope of retention and cause sensitive conversations to be stored under false privacy expectations.

Vague Triggers

High

Confidence: 98% confidence
Finding: The auto-save trigger is extremely broad, instructing capture of essentially anything 'worth remembering,' including facts, preferences, instructions, and project details. This default-open rule encourages over-collection of sensitive data without clear minimization, consent boundaries, or classification safeguards, increasing privacy and data-handling risk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill silently loads prior conversation-derived context at the start of a new session without a strong upfront warning in the description. Hidden retrieval of stored personal or project context can surprise users, influence responses using stale or sensitive data, and undermine informed consent.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to silently ingest and persist user details into long-term memory by default, combining automatic retrieval with ongoing capture. In context, this is especially risky because the skill is explicitly designed for persistent memory, so silent operation can normalize background profiling and retention of conversation-derived data without meaningful user awareness.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.