long-term-memory

• Outcome: Review
• Latest audit: May 28, 2026 · 1:56 PM UTC
• Version: 1.2.0

Overview

This is a local long-term memory skill with no exfiltration found, but it persistently stores and reuses potentially sensitive conversation details with limited scoping or safeguards.

Install only if you intentionally want persistent local memory. Avoid storing secrets, credentials, regulated data, or private personal details; review what is saved, use project tags carefully, delete unwanted memories with the provided forget command, and be aware that recalled memories may appear in future prompts or local plaintext files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises and instructs shell execution and persistent file/database writes, but it does not declare any permissions or equivalent safety boundaries. That creates a transparency and governance gap: an agent or platform may invoke a skill that can write local state and execute commands without explicit operator awareness or approval.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The description says the skill is suitable for essentially all AI scenarios, which is overly broad for a component that persistently stores cross-session memory. Overbroad applicability increases the chance the skill is auto-selected in contexts involving sensitive, regulated, or ephemeral data where persistent retention is inappropriate.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The overview emphasizes long-term, cross-session memory but does not clearly warn users that conversation-derived information will be persistently stored locally and may later be injected back into prompts. This is dangerous because users may unknowingly disclose sensitive personal data, credentials, business information, or regulated content that then remains searchable across sessions.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The auto-capture feature is presented as automatically detecting and saving decisions, facts, preferences, problems, company names, versions, and prices, but it gives no warning that this may capture sensitive or confidential user information. In context, this is more dangerous because the skill is specifically designed for broad, cross-session retention and retrieval, so accidental collection can propagate private data into future agent responses.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The configuration enables `auto_capture` and `context_inject` by default, causing user-provided content to be persistently stored and later reused without an explicit consent or disclosure flow. In a long-term memory skill, silent retention is especially risky because users may reveal credentials, personal data, or business-sensitive details assuming the interaction is ephemeral.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: `AutoCapture.auto_remember` analyzes arbitrary text and stores detected sentences directly into persistent storage without informing the user at the time of capture. Because the trigger set explicitly targets facts, preferences, projects, and contact-like information, this can silently accumulate sensitive personal or organizational data over time.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The generated memory context is written to `current_context.md`, creating a secondary plaintext artifact containing recalled information that may include sensitive prior conversation data. Writing this file without clear disclosure or access controls increases the chance of local exposure through backups, shared workspaces, or other tools reading the file.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The test file stores and then searches/prints user-identifying and preference data such as a person's name, communication preference, workspace, and stock interests in a long-term memory system. In a skill explicitly designed for persistent cross-session memory, using realistic personal data in test fixtures normalizes retention and disclosure of sensitive information and can lead to accidental exposure in logs, demos, CI output, or copied sample code.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The context-building logic retrieves stored memories and injects them into prompts or prints them to console, which can resurface previously captured secrets, personal data, or proprietary information in later sessions. In a long-term memory skill, this materially raises confidentiality risk because old sensitive content can leak into unrelated tasks, logs, terminals, or downstream model calls.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The auto-capture rules explicitly target contact and personal-information patterns such as phone numbers, email, company, address, and preferences, then persist them for later retrieval. This creates a durable store of potentially regulated or highly sensitive data without minimization, consent, or purpose limitation, making later disclosure or misuse more damaging.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.