Security audit

神经记忆增强系统

Security checks across malware telemetry and agentic risk

Overview

This appears to be a local persistent memory skill, but it stores and reuses conversation context across sessions with broad activation language and limited user-control guidance.

Install only if you want the agent to keep local, cross-session memory under ~/.neuralmemory and potentially reuse prior conversation details later. Avoid storing secrets, personal data, customer data, or unrelated project context unless you have a clear process to inspect and delete the memory database, and review the neural-memory package before enabling exec-backed setup.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: The manifest presents the skill as a local memory/recall utility, but later sections broaden it into generic file processing, API integration, and command execution. This scope expansion materially increases the actions an agent may take under a benign-looking label, creating capability confusion and a path to over-privileged or unintended execution.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The skill advertises network/API behavior despite being described as a local associative memory system. Unjustified network-oriented claims can cause agents or operators to permit external communication and data handling outside the expected trust boundary, increasing the risk of unintended data exposure.

Intent-Code Divergence

Medium

Confidence: 82% confidence
Finding: The documentation states the core functionality does not depend on external LLM or embedding services, yet the dependency section marks an LLM API as required. This contradiction can mislead users about data flow and trust assumptions, causing them to expose conversation content to external model providers unexpectedly.

Vague Triggers

High

Confidence: 91% confidence
Finding: The activation description is extremely broad, covering efficiency, automation, batch processing, and workflow optimization. Such generic triggers can cause the skill to activate in many unrelated contexts, allowing persistent memory and exec-enabled behaviors to run when the user did not intend to invoke a memory system.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill stores conversation-derived memory in persistent local storage but does not foreground that behavior with a clear warning at activation time. Users may disclose sensitive information without realizing it will be retained across sessions, creating privacy and data retention risk.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The workflow instructs the agent to inject recent memories into new sessions and to recall prior conversation content on topic mentions. This creates a semantic cross-session data leak risk, where sensitive information from one task or user context can be surfaced in another without fresh authorization.

Ssd 3

Medium

Confidence: 86% confidence
Finding: The advertised auto-extraction of conversation text into memory encourages broad retention of user-provided data without clear sensitivity boundaries or minimization rules. This increases the chance that secrets, personal data, or confidential context are stored and later resurfaced unintentionally.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.