Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local persistent-memory helper that stores notes under ~/memory as advertised, but users should understand it may save important information across sessions.
Install this only if you want the agent to keep long-term local notes in ~/memory. Avoid saving secrets, credentials, private personal data, or regulated business information unless you are comfortable with that data remaining on disk and being included in future memory searches.
The skill claims constrained behavior limited to ~/memory/, but declares broad write and especially exec capabilities that can modify arbitrary files or run arbitrary shell commands if the agent follows later instructions unsafely. That mismatch weakens trust boundaries and makes prompt-induced abuse more dangerous because the available tools exceed the documented least-privilege scope.
The activation condition is extremely broad ('use when the user needs persistent-memory-engine-free-related functionality'), which can cause the skill to trigger in ambiguous situations and perform persistent storage actions outside narrow user intent. In a skill with file-write and exec capabilities, overbroad invocation increases the chance of unnecessary retention of sensitive data or unintended command-backed operations.
The skill instructs immediate writes to persistent local storage without a clear, mandatory warning that user content will be stored across sessions on disk. This is dangerous because users may disclose sensitive personal, project, or credential-adjacent information assuming ephemeral processing, leading to silent long-term retention and privacy/security exposure if the host is shared, backed up, or later compromised.
No suspicious patterns detected.
