Infinite Memory Vault Free

• Outcome: Review
• Latest audit: Jul 22, 2026 · 11:51 AM UTC
• Version: 1.0.0

Overview

The skill is a local memory vault, but it encourages automatic long-term storage of personal and business details with weak consent and privacy boundaries.

Install only if you want the agent to create and maintain a durable local ~/memory/ vault. Before use, require explicit confirmation before saving new personal, customer, credential-adjacent, or confidential business information, and review or delete the vault regularly.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The skill repeatedly claims the free edition is fully offline with zero network dependency, but the error-handling section instructs automatic ping-based connectivity testing and retries. That contradiction can cause an agent with exec access to perform unexpected network-related commands, violating user expectations and expanding the operational surface beyond a local-only memory tool.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The capability scope claims applicability to database/SQL and data-storage-management scenarios even though the rest of the skill is a markdown/filesystem memory vault. This mismatch can cause the agent to over-apply the skill in contexts involving databases, leading to inappropriate actions, unsafe command generation, or writes outside the intended local-memory boundary.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The same capability text asserts support for database/SQL scenarios while the skill elsewhere defines itself as a local markdown/filesystem memory system. Such internal contradictions are dangerous because they make tool behavior ambiguous, increasing the chance that an agent invokes exec in broader, riskier contexts than the user intended.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger and applicability language is broad, fragmented, and internally inconsistent, including unrelated scenarios such as database operations. Unclear activation conditions are risky in agent skills because they can cause the skill to activate unexpectedly and perform file writes or exec-driven actions without a well-bounded user intent.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to write to persistent storage under ~/memory/ as part of normal operation, but it does not present a clear user-facing warning or consent step before modifying local files. In the context of an agent with read and exec tools, silent persistence is a meaningful safety issue because it can create lasting data changes the user did not explicitly authorize.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The examples explicitly write personally identifiable and project-related information into persistent local files under ~/memory/ without any warning, consent flow, retention guidance, or privacy boundaries. In a memory/notes skill, this is contextually more dangerous because users are encouraged to store ongoing contact, decision, and project data, which can normalize persistence of sensitive information that may later be exposed, synced, or mishandled.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The skill directs the agent to persist user-shared project details, contact information, and decision history into long-term files by default. This creates a real data-retention and privacy risk because sensitive personal or internal business information may be stored indefinitely in plain markdown without minimization, consent, classification, or retention controls.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The 'write immediately before replying' rule encourages indiscriminate logging of conversation content as a default behavior. In a memory skill, this context makes the issue more dangerous because users may share credentials, personal details, or sensitive business context conversationally, and the agent is being instructed to persist it automatically.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The examples explicitly encourage storing complete contact archives and full decision reasoning, which are likely to contain personal data, confidential discussions, and internal rationale. Because the storage format is plain-language local files, compromise of the host account or accidental sharing of the directory could expose a broad set of sensitive information.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.