Neural Context Engine Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:22 AM UTC
• Version: 1.0.0

Overview

This memory skill is mostly aligned with its stated purpose, but it automatically stores and recalls cross-session conversation content without enough user control or trust-boundary safeguards.

Review before installing. Use it only if you are comfortable with a local cross-session memory database, pin and isolate the neural-memory package, avoid storing secrets or confidential project data, and require explicit approval before memories are saved or recalled.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:73

Finding

Unpinned Third-Party Package Is Installed and Executed with Agent Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 73-96
Vulnerability Type: Unpinned executable dependency and software supply-chain exposure
Risk Level: Medium

Vulnerable Code

bash

pip install neural-memory
nmem init

nmem stats

json

{
  "mcpServers": {
    "neural-memory": {
      "command": "python3",
      "args": ["-m", "neural_memory.mcp"],
      "env": {
        "NEURALMEMORY_BRAIN": "default"
      }
    }
  }
}

Technical Analysis

The Skill directs users or Agents to install neural-memory from the default Python package index without specifying an exact version or validating a cryptographic hash. It then immediately executes package-provided commands and configures the package module as a persistent MCP integration.

The project contains only SKILL.md; it does not include the dependency implementation, a lock file, integrity hashes, or a verifiable source reference. Consequently, the dependency's implementation and its local-only data-handling claims cannot be validated from the audited artifact.

Because package installation can run build or installation logic and the resulting commands execute with the invoking Agent's permissions, a compromised package release, package-name takeover, or malicious transitive dependency could introduce arbitrary code.

Attack Path

1. An attacker compromises the neural-memory distribution, its publisher account, or one of its transitive dependencies.
2. The unpinned installation command resolves to the attacker-controlled release.
3. Installation logic or the subsequent nmem init command executes malicious code.
4. The configured python3 -m neural_memory.mcp process continues executing the compromised package whenever the MCP server is started.
5. The malicious process accesses resources available to the Agent process, potentially including MCP inputs, local files, environment variables, and netwo ...[truncated 544 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed exact version rather than installing the latest available release.
2. Require cryptographic hashes with a hash-locked requirements file, such as pip install --require-hashes.
3. Publish and reference the canonical source repository and verify that the packaged artifact corresponds to reviewed source code.
4. Lock and audit all transitive dependencies using a reproducible dependency-management process.
5. Install the package in an isolated virtual environment or container under a dedicated, unprivileged account.
6. Restrict the MCP process's filesystem, environment-variable, credential, and network access to the minimum required.
7. Avoid automatic installation or startup. Require explicit operator approval after displaying the exact package version and integrity information.
8. Periodically scan the pinned dependency and its transitive dependency graph for known vulnerabilities and publisher changes.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:107

Finding

Untrusted Conversation Content Can Persist and Influence Future Agent Sessions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 107-116
Vulnerability Type: Persistent memory poisoning through automatic storage and context injection
Risk Level: High

Vulnerable Code

markdown

1. Call nmem_context at the beginning of a session to inject recent memories.
2. Call nmem_recall when the user mentions a specific topic.

During the conversation:
1. After making a decision: nmem_remember type="decision"
2. After an error occurs: nmem_remember type="error"
3. When the user expresses a preference: nmem_remember type="preference"

Technical Analysis

The Skill establishes a workflow in which conversation-derived decisions, errors, and preferences are written to persistent memory, while recent memories are injected into the Agent at the beginning of later sessions. It does not define a trust boundary between recalled data and executable instructions.

No documented control requires user confirmation before persistence, records the provenance or trust level of a memory, sanitizes instruction-like content, or requires recalled text to be treated strictly as quoted data. There is also no documented project, user, or tenant isolation rule in this workflow. An attacker can therefore attempt to store instruction-shaped text as a decision, error, or preference and have it replayed in a later session.

The issue arises from the combination of persistent writes and automatic future context injection. Ordinary memory storage is not inherently unsafe, but recalled content becomes a poisoning channel when it can affect Agent behavior without explicit validation and without being segregated from trusted instructions.

Attack Path

1. An attacker provides crafted conversation content framed as a preference, decision, error resolution, or other information that the Skill recommends storing.
2. The Agent passes that content to nmem_remember, causing it to persist beyond the current conversa ...[truncated 1194 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user confirmation before storing conversation-derived content in persistent memory.
2. Treat every recalled memory as untrusted data, not as an instruction, policy, or authorization.
3. Place recalled content inside a clearly delimited data structure and instruct the Agent never to execute directives contained within it.
4. Store provenance metadata, including originating user, session, timestamp, project, and trust level.
5. Isolate memory databases by user, project, and security domain rather than relying on a shared default memory space.
6. Reject or quarantine memories containing tool directives, requests to override policies, encoded payloads, credential requests, or other instruction-like patterns.
7. Present proposed memories for review and provide mechanisms to inspect, edit, expire, and delete them.
8. Apply retention limits and avoid storing secrets, credentials, personal data, or complete sensitive conversation transcripts.
9. On recall, rank trusted operator-approved memories above unverified conversational memories and visibly identify the source of each item.
10. Add tests demonstrating that malicious instructions stored as preferences, decisions, or errors cannot alter later Agent behavior.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Manifest 与正文多处强调该技能“零LLM依赖”“纯算法实现”，表明其定位是不依赖 LLM 或外部智能服务的本地记忆引擎。然而依赖说明中又明确写明“LLM API | 必需”，这与技能核心描述直接不一致，属于声明能力边界与实际使用前提的语义冲突。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs the agent to persist recent context, decisions, errors, and preferences across conversations without requiring a clear upfront notice or consent before storage begins. In a memory skill, that context makes the issue more dangerous because users may unknowingly have sensitive personal, operational, or credential-adjacent content retained locally and later resurfaced.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly directs the agent to store user preferences, decisions, errors, and recent context across sessions, creating persistent memory of potentially sensitive content. In a recall-oriented system, this raises the risk of later unintended disclosure, over-collection, and retention of secrets or confidential project details, especially since the instructions encourage automatic use at session start and during normal conversation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The activation scope is defined with a broad keyword sweep instead of narrow triggers and exclusions, which can cause the agent to invoke the skill in unrelated contexts. Because this skill persists and recalls cross-session memory, over-triggering increases the chance of storing or surfacing sensitive conversation data when the user did not intend memory features to run.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The tool guidance allows storing arbitrary memory content and later returning related memories through semantic recall, which can cause sensitive information to be resurfaced in unrelated or overly broad contexts. Because the retrieval model is concept-based rather than exact-match, the skill context makes this more dangerous: it may recall confidential data even when the user query does not explicitly name the secret.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

L358 的表述给出强保证：数据不发送到任何外部服务，仅在括号中弱化为“除非配置可选的嵌入提供方”。而在 L393 又明确说明可配置外部嵌入提供方 API Key 以增强语义能力，意味着该技能文档并非始终严格本地闭环。此类“完全本地/不外传”与“可接入外部提供方”的表述会使实际数据流向意图不清。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The statement "完全中文化表达，适配中文用户工作流" indicates the skill is designed around a specific language and user locale, but the document does not present this as an optional mode or a clearly justified regional constraint. Under the policy, forcing a specific language without user opt-in is a natural-language policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.