Security audit

Skills

Security checks across malware telemetry and agentic risk

Overview

This memory skill is mostly purpose-aligned, but it creates persistent background syncing of sensitive workspace files and exposes recovery credentials in ways users should review carefully.

Install only if you are comfortable with a paid remote memory service continuously syncing selected workspace files. Treat the recovery URL as a password, avoid committing MEMORY.md, review the daemon/systemd setup before enabling it, and do not run distillation unless you accept sending memory contents to DeepSeek.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (39)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill advertises broad operational behavior including shell execution, environment variable use, and file writes, but does not declare an equivalent permission boundary in a machine-enforceable way. That makes it easier for an agent or user to invoke installation, persistence, or file-modifying actions without clear upfront consent and weakens sandbox/policy enforcement.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description frames the skill as a memory tool, but the documented behavior expands into package installation, daemon/service registration, continuous file exfiltration to a remote service, third-party API use, and payment workflow handling. This mismatch undermines informed consent and can cause operators to approve a much more privileged and persistent capability set than they intended.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The installer writes a root-level systemd unit into /etc/systemd/system and enables it at boot, creating persistent host-level execution beyond the narrow expectations of a memory-management skill. In context, the service continuously watches workspace files and pushes their contents to a remote endpoint, so the persistence and privilege scope materially increase the blast radius if the watcher script is buggy, replaced, or abused.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The installer writes the full recovery URL containing the token into MEMORY.md inside a workspace that may be read by agents, indexed by tools, synced to repositories, or shared with other assistants. This converts a bearer credential into natural-language workspace content, greatly increasing the chance of unintended disclosure and unauthorized memory recovery.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The script installs and starts a persistent daemon that continuously watches files and pushes changes, which creates ongoing data exfiltration risk beyond the one-time install action. In an agent skill context, persistence and background monitoring are especially sensitive because users may not fully understand what files are being observed or transmitted over time.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script’s advertised purpose is backing up core identity files, but in tarball mode it also includes MEMORY.md and the last 7 days of diary files. That expands collection to substantially more sensitive data than users would reasonably expect, increasing privacy and secret-exposure risk during external transmission.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The script prints a follow-up curl example that interpolates the real API key into terminal output instead of showing a literal placeholder. This can leak the credential into shell history, logs, screenshots, CI captures, terminal scrollback, or any monitoring attached to the session.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill metadata says memory data is only sent to the vendor memory service, but the LLM distillation path sends raw memory titles and contents to DeepSeek. This creates an undisclosed third-party data flow for potentially sensitive persistent memory, breaking data handling expectations and increasing confidentiality risk.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The script attempts to extract a platform credential from WORK_DIR/IDENTITY.md when no API key is provided, allowing remote operations using locally stored identity material. Reading local identity files for authentication without clear user consent expands the credential exposure surface and can cause the skill to act with privileges the user did not intend to delegate.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The header states that non-dry-run mode only performs deduplication, stale-marking, and report writing, but the script also performs external LLM processing and submits results back to a remote API. This misleading behavior prevents informed consent and can cause users to run networked data processing they were not expecting.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The script includes owner billing, payment-link generation, payment verification, and upgrade logic that is materially outside a memory-management skill’s stated purpose. This scope expansion increases attack surface and creates opportunities for social engineering, unexpected external data flows, and unauthorized monetization prompts from within an agent-facing tool.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script can create and enable systemd services, including instructions to use sudo, which gives it persistence capabilities beyond a normal memory helper. In the context of an agent skill, persistence is sensitive because it can convert a one-time install into an always-running background process that continuously monitors and exfiltrates workspace data.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The prove routine collects hostname and workspace path and sends them to a remote endpoint, even though that information is not necessary for core memory storage. Hostnames and filesystem paths can reveal environment structure, usernames, tenant naming, and other operational details useful for fingerprinting or targeting.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README tells users to store a tokenized recovery URL in MEMORY.md, but does not label it as a secret or warn against committing, sharing, or exposing that file. Because the token appears to grant recovery of all persisted memories, anyone who obtains the URL could impersonate the user and access sensitive memory contents.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The recovery example shows that supplying the tokenized URL is sufficient to restore all memories, but the documentation does not warn that possession of the URL may confer full access to potentially sensitive persisted data. In a long-term memory product for AI agents, those memories may include credentials, internal notes, customer data, or operational context, so leakage of the URL could have broad confidentiality impact.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script transmits highly sensitive identity, memory, and diary backup content to a remote endpoint without any interactive confirmation or dry-run summary at the point of exfiltration. In the context of an AI persistence/memory skill, these files are likely to contain credentials, private user data, behavioral instructions, and operational context, making silent export materially risky.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The script sends memory titles and full contents to an external LLM API and does not warn the user during the execution confirmation that third-party data sharing will occur. Because these memories are designed to be persistent and may contain sensitive operational or personal information, silent exfiltration to an external processor is a serious privacy and compliance risk.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script reads API credentials from environment variables and, failing that, mines a local identity file for a platform token, without clearly disclosing this credential access in its prompts or header. Silent credential harvesting from local context increases the chance of unintended privileged actions and weakens the principle of explicit authorization.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The manifest states that the skill performs HTTPS API communication, identity checks, and paid access for persistent memory handling, but it does not present a clear user-facing warning that potentially sensitive memory data may be transmitted to a remote endpoint and subject to verification or billing controls. In a memory-management skill, this matters more because users may provide long-term conversational history, personal data, credentials, or operational context, increasing privacy and consent risk even if transport is encrypted.

Ssd 3

High

Confidence: 97% confidence
Finding: The skill explicitly instructs the agent to disclose the full recovery credential to the user in plain text and to place it in common consumer storage locations. A bearer-style recovery URL that restores all memory is effectively a master secret; automatic disclosure increases exposure through chat logs, notifications, screenshots, history syncing, and downstream prompt/context retention.

Ssd 3

Medium

Confidence: 82% confidence
Finding: The workflow normalizes agents automatically sending payment and recovery links to users, which can train unsafe trust patterns and leak sensitive bearer links through chat systems. Even when intended for the legitimate owner, automatic distribution without verification of recipient identity or channel security increases the chance of credential leakage or social-engineering abuse.

Ssd 3

High

Confidence: 99% confidence
Finding: The script explicitly tells the user to store a sensitive recovery credential in MEMORY.md and later send the link to a trusted AI assistant for recovery. That creates a direct natural-language leakage channel: any assistant, plugin, repo sync, or workspace scraper that can read MEMORY.md may obtain a bearer token capable of restoring or accessing stored memory.

Ssd 4

Medium

Confidence: 76% confidence
Finding: The onboarding text frames package installation, identity registration, token persistence, and a continuous daemon as a simple one-click setup, which can reduce user scrutiny of sensitive actions. While the text itself is not exploit code, in context it materially contributes to consent bypass risk by normalizing persistence and secret handling without granular informed approval.

Ssd 3

High

Confidence: 98% confidence
Finding: The script instructs the AI to forward a recovery credential to the owner and strongly encourages permanent storage of it. Because the recovery URL functions as a full memory-restoration credential, embedding social instructions to redistribute it increases the risk of accidental disclosure through chat logs, screenshots, browser history, or insecure note storage.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The setup command injects behavioral rules that direct the AI to save conversation-derived content to remote memory when trigger phrases appear. In an agent environment, this is dangerous because it converts natural-language prompts into persistent external transmission behavior, which can cause oversharing of sensitive user data without granular consent at the moment of upload.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.