Security audit

Context Vault Manage

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a memory-vault guide, but it asks for broad local command/write authority and includes under-scoped outbound callback and security claims for sensitive stored memories.

Review before installing. This skill is not clearly malicious, but it may retain sensitive memory on disk and in vector indexes, and its callback and exec/network language are under-scoped. Only use it in a workspace where persistent memory storage is acceptable, avoid secrets or regulated data unless you add controls, and require explicit review before any callback URL or command execution is used.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The skill is presented as a local context/memory vault, yet it explicitly accepts a callback_url for asynchronous completion. That introduces outbound communication capability not clearly aligned with the core feature set and creates a path for memory contents or metadata to be sent off-host without adequate validation, transport restrictions, or disclosure.

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: The documentation advertises general command execution and network troubleshooting/operations even though the stated purpose is memory management. In a skill with exec, write, grep, and glob permissions, broad operational guidance increases the chance that future implementations or user-driven flows invoke shell commands or network actions unrelated to the memory-vault function, expanding attack surface and enabling command misuse or data exfiltration.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The file claims command execution is protected by a whitelist and that user input is not concatenated, but no actual implementation or enforceable control is shown. Security claims without corresponding controls are dangerous because operators may trust the skill to run safely while the broad exec exposure remains available for unsafe command construction in practice.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The documentation asserts HTTPS and SSL verification are enforced, but the interface accepts arbitrary callback URLs and does not describe any validation or enforcement mechanism. This discrepancy can lead to plaintext transmission, SSRF-like behavior, or delivery of memory-derived data to attacker-controlled endpoints under a false assumption of transport security.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The skill promotes persistent storage, vectorization, and auto-archival of memory content, but it does not clearly warn users that submitted memory may be retained on disk or in vector databases over time. For a context-vault tool, this matters because users may place sensitive conversational or project data into the system without understanding retention, indexing, and later retrieval implications.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: Callback URL support is documented without any privacy or security warning that data may leave the local environment. Because this skill manages memory content that may contain sensitive user or project information, undocumented outbound transmission materially increases confidentiality risk and can surprise users who expect a local-only memory tool.

Static analysis

No suspicious patterns detected.