Security audit

Simple Memory Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local memory skill, but it tells agents to automatically save user information before responding without clear consent, filtering, or deletion controls.

Install only if you want an agent to keep local memory across sessions. Before using it, decide what may be stored, avoid sharing secrets or sensitive personal data unless you intend it to persist, and review or delete the generated memory files when needed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to persist user preferences and other information to local storage without an explicit consent prompt or warning about retention. This creates a privacy risk because users may disclose sensitive information expecting ephemeral handling, while the agent silently stores it across sessions.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The skill directs the agent to save user-provided information and preferences by default before responding, making persistence automatic rather than exception-based. In a memory skill, that context makes the behavior intentional, but still dangerous because it normalizes storing potentially sensitive user data without contextual minimization, consent, or classification controls.

Ssd 3

Medium

Confidence: 99% confidence
Finding: The write-ahead logging policy requires saving user statements, decisions, deadlines, and corrections before responding, which can capture broad categories of personal or confidential information automatically. Because this occurs prior to any response, the user may have no meaningful opportunity to consent, correct scope, or prevent retention of sensitive content.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: SKILL.md:157