Security audit

Persistent Memory Engine

Security checks across malware telemetry and agentic risk

Overview

This is a plausible memory skill, but it can persist and index personal conversation details with limited consent controls and has unclear cloud-vector data handling.

Install only if you want an agent to maintain a durable local memory folder. Before use, set clear rules requiring confirmation before saving new memories, avoid storing secrets or sensitive personal details, keep semantic/vector retrieval local unless you explicitly approve a provider, and review trash cleanup settings so important records are not permanently deleted unexpectedly.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 85% confidence
Finding: The skill is presented as a local-only memory system, but it also documents optional integration with external vector databases and cloud-backed semantic retrieval. That expands the trust boundary and can cause sensitive memory contents to be transmitted to third-party services or additional local daemons without clear consent or a strong security model.

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The skill claims 'no network requests' while also describing cloud vector service support that would necessarily require network access. This contradiction can mislead users and agents into handling sensitive memory under false assumptions, increasing the risk of unintended exfiltration.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The workflow says user-shared information should be written immediately to ~/memory/ with index updates, but it does not prominently require prior user confirmation that local files will be created or modified. In an agent setting, silent persistence of conversation-derived data can violate user expectations and create lasting privacy and integrity issues on disk.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The lifecycle design includes permanent deletion after the trash retention window, but the irreversible nature of that cleanup is not surfaced as a prominent safety warning. Users may assume the memory system is recoverable and lose important stored data without informed consent.

Ssd 3

Medium

Confidence: 89% confidence
Finding: The skill is explicitly designed to persist user-shared information across sessions, including projects, people, preferences, and decisions. Even without obvious malicious intent, broad natural-language retention increases the risk of storing personal, sensitive, or confidential data that may later be exposed through retrieval, backup, syncing, or third-party integrations.

Ssd 3

Medium

Confidence: 91% confidence
Finding: The lifecycle rules instruct the agent to write down important information whenever the user shares it, encouraging broad and subjective data capture. In practice this can lead to over-collection of personal or confidential details and long-term retention beyond what the user intended.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The usage flow says to write user-shared information immediately and 'not wait,' which normalizes automatic retention of conversational content. In an agent environment, this creates a meaningful privacy risk because users may not realize their statements are being durably stored and indexed for future retrieval.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.