Strategy Constitutional Memory

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:23 PM UTC
• Version:
  1.0.0

Overview

This is a local strategy-memory helper that stores disclosed lesson and ban files and shows no evidence of hidden network access, credential use, or destructive behavior.

Install this only if you want persistent local strategy lessons and banned patterns to influence later coding work. Review lessons.json and bans.json periodically, avoid storing secrets or untrusted prompt-like text in lessons or evidence, and use the provided cli.py entry point unless you have verified a separate orchestrator module exists.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill documentation describes persistent writes to local files (`memory/lessons.json` and `memory/bans.json`) and append/update operations such as `add_lesson`, `record`, and seeding, but the skill metadata declares no permissions for file writing. This is a real capability/permission mismatch: even if the writes are expected for the skill’s purpose, undeclared persistence weakens least-privilege controls and can lead to unauthorized modification of local state, prompt-influencing memory, or corruption of project files if the implementation is broader than documented.

VirusTotal

66/66 vendors flagged this skill as clean.