Security audit

Tinmem Memory System

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent persistent-memory tool, but it automatically stores and reinjects conversation-derived memories without clear consent, retention, or safety controls.

Install only if you are comfortable with conversation details being stored locally across sessions and automatically reused. Before using it with sensitive work, confirm there are controls to review, delete, limit, and sanitize memories, and that recalled memories are treated as untrusted context rather than instructions.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:109
Finding: Automatic Persistent Memory Collection Enables Cross-Session Memory Poisoning
Content: View full analysis
` tags - New memories are automatically extracted after each conversation turn - Similar memories are deduplicated using LLM-based analysis - All memories persist across sessions in a local LanceDB database ``` ### Technical Analysis The Skill describes a system that automatically extracts information from each conversation turn, stores it persistently, and injects the resulting memories into the context of future responses. No requirement is specified for explicit user consent, provenance verification, sensitive-data filtering, retention limits, or separation of trusted instructions from untrusted remembered content. Because conversation content can be attacker-controlled, automatic extraction may preserve malicious instructions, deceptive claims, or adversarial text as memory. Injection through `` tags then places that content in future prompt contexts. If the consuming agent does not treat these entries strictly as untrusted data, persistent memories may influence future decisions or behavior across sessions. The reviewed package contains documentation only. It does not contain an implementation demonstrating how m ...[truncated 2110 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly describes persistent storage of user information and states that new memories are automatically extracted after each conversation turn, but it provides no consent, retention, minimization, or privacy-warning language. In an assistant context, this can lead to silent collection and long-term retention of sensitive personal data across sessions, increasing the risk of privacy violations, unexpected profiling, and unauthorized reuse of past user data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill documents a memory deletion capability but gives no warning that deletion may be destructive, broad when using query-based matching, or potentially irreversible. In a persistent memory system, this creates risk of accidental or overbroad data loss, especially if an agent invokes deletion automatically or based on ambiguous queries.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.