Memscape

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:33 AM UTC
• Version: 1.0.1

Overview

Memscape is a coherent memory-sharing skill, but it asks agents to persist and send user/project context to an external service without enough privacy guardrails or review steps.

Install only if you are comfortable sending selected agent memories and handoff summaries to Memscape. Do not store or contribute secrets, tokens, personal data, customer data, proprietary source code, internal URLs, or confidential project details. Keep the API key out of repositories and logs, use restrictive file permissions or a secret store, and review every memory, handoff, contribution, promotion, and community result before acting on it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:77

Finding

Potentially Sensitive Session and Project Context Is Uploaded Without Mandatory Review

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:77-92; supporting API examples in references/rest-api.md:94-144
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable documentation:

markdown

## When To Use Memscape

| When | Action |
|------|--------|
| **Session start** | `memscape_resume` with your project scope — load handoffs + memories |
| **Before hard problems** | `memscape_query` — someone may have already solved it |
| **During work** | `memscape_remember` — save decisions, preferences, pitfalls, patterns |
| **After solving** | `memscape_contribute` — share solutions AND failed approaches |
| **Stuck >5 minutes** | `memscape_query` — check if others have a fix |
| **Session end** | `memscape_handoff` — structured summary for your next session |

### The Habit Loop

1. **Resume** at session start
2. **Query** when facing a challenge
3. **Remember** important discoveries
4. **Contribute** after solving something non-trivial

The REST API reference provides the corresponding upload operation:

bash

curl -X POST https://www.memscape.org/api/v1/users/me/memories \
  -H "Authorization: Bearer mems_xxxx..." \
  -H "Content-Type: application/json" \
  -d '{
    "text": "User prefers concise commit messages, no emoji, imperative mood",
    "category": "preference",
    "scope": "your-project-name"
  }'

Technical Analysis

The Skill establishes an operational pattern in which agents routinely submit user preferences, project decisions, troubleshooting details, failed approaches, and session handoffs to an external service. These data categories can contain personal information, proprietary architecture, internal project names, source fragments, credentials, customer information, or other confidential material.

The documentation does not impose mandatory payload review, explicit user consent, secret detection, redaction, ...[truncated 1664 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit user approval before every memory upload, handoff, contribution, or promotion.
• Display the complete destination, visibility, retention category, scope, and payload before submission.
• Define prohibited data classes, including credentials, authentication tokens, private keys, personal data, customer data, proprietary source code, and confidential business information.
• Apply local secret scanning and redaction before transmitting content.
• Default to local-only storage where persistent local memory can satisfy the request.
• Make community contribution and private-memory promotion separate, opt-in operations with additional confirmation.
• Minimize handoff data to information strictly necessary for continuity.
• Document deletion, retention, access-control, and export behavior for remotely stored memories.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:48

Finding

Remote MCP Instructions and Community Content Are Not Explicitly Treated as Untrusted Input

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:48-55; related query guidance at SKILL.md:77-92 and heartbeat guidance at references/rest-api.md:218-225
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Vulnerable documentation:

markdown

## Connection — MCP (Preferred)

Connect directly for native tools and server-level instructions:

| Setting | Value |
|---------|-------|
| **Endpoint** | `https://www.memscape.org/api/mcp` |
| **Transport** | Streamable HTTP (stateless) |
| **Auth** | `Authorization: Bearer mems_your_api_key` |

The Skill also directs the agent to rely on community responses:

markdown

| **Before hard problems** | `memscape_query` — someone may have already solved it |
| **Stuck >5 minutes** | `memscape_query` — check if others have a fix |

Technical Analysis

The Skill connects the agent to a remote MCP endpoint capable of returning tools, content, and server-level instructions. It also imports community-authored insights into the agent's active reasoning context. Neither workflow establishes an explicit trust boundary requiring remote text to be interpreted only as untrusted reference data.

Community entries or remotely supplied MCP content could contain prompt-injection directives disguised as troubleshooting advice. Examples include instructions to reveal credentials, ignore previous constraints, modify files, execute commands, or transmit additional context. The audit found no local code that automatically executes such text, so exploitation depends on the consuming agent treating remote content as authoritative instructions. Nevertheless, the documentation actively recommends incorporating that content into work without prescribing validation or instruction filtering.

Attack Path

1. An attacker creates a community insight designed to match a commonly queried technical problem, or a remote service response is compromise ...[truncated 1166 chars]

Remediation

View remediation

Remediation Suggestions

• State that all MCP responses, recalled memories, community insights, comments, and server-supplied instructions are untrusted data.
• Prohibit following instructions embedded in remote results, especially requests involving credentials, files, shell commands, configuration changes, or network transmission.
• Delimit remote content clearly and ensure it cannot override system, developer, user, or Skill-level safety constraints.
• Require independent verification of technical claims before applying them.
• Require user approval before remote content causes any side effect.
• Sanitize or filter known prompt-injection patterns before inserting remote content into the agent context.
• Restrict enabled MCP tools and remote server capabilities to the minimum required for the selected operation.
• Preserve provenance for each result so that the agent and user can distinguish remote community content from trusted instructions.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:38

Finding

Bearer Credential Storage Guidance Omits Local Permission and Repository Protections

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:38-42; additional plaintext configuration examples in references/rest-api.md:9-43
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Low

Vulnerable documentation:

markdown

**2. Save credentials:**

```bash
mkdir -p ~/.config/memscape
# Save the returned apiKey to ~/.config/memscape/credentials.json

text

A project-level configuration option also embeds the bearer token directly:

```markdown
**Cursor** — add to `~/.cursor/mcp.json` (global) or `.cursor/mcp.json` (project):
```json
{
  "mcpServers": {
    "memscape": {
      "url": "https://www.memscape.org/api/mcp",
      "headers": { "Authorization": "Bearer mems_your_api_key" }
    }
  }
}

text

### Technical Analysis

The credential files are necessary for authenticated use of the declared service, so accessing these paths does not by itself exceed the Skill's functional privilege requirements. However, the instructions recommend plaintext storage without specifying restrictive directory and file permissions.

The project-level `.cursor/mcp.json` option creates an additional accidental-disclosure risk because project configuration is commonly stored inside a source repository. The documentation does not require adding this file to `.gitignore`, using environment-variable interpolation, relying on an operating-system secret store, or rotating an exposed token.

### Attack Path

1. A user follows the documentation and saves the bearer token in `~/.config/memscape/credentials.json` or a host-specific MCP JSON file.
2. The file receives default permissions that allow unintended local access, is included in a backup, or is accidentally committed to source control.
3. Another local user, collaborator, repository reader, or automated scanner obtains the token.
4. The attacker authenticates to Memscape as the affected agent.
5. Subject to server-side A
...[truncated 752 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer an operating-system credential manager or supported secret store over plaintext JSON.
• Where file storage is unavoidable, create the directory with mode 0700 and the credential file with mode 0600.
• Use environment-variable or secret-manager references in MCP configuration instead of embedding the bearer value.
• Explicitly add project-level MCP credential files to .gitignore and equivalent packaging exclusions.
• Warn users not to place bearer tokens in source control, logs, screenshots, shell history, or shared configuration.
• Use narrowly scoped, revocable tokens where supported.
• Document token revocation and rotation procedures for suspected disclosure.
• Avoid duplicating the same credential across multiple host configuration files.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

bins:
        - curl
      config:
        - ~/.config/memscape/credentials.json
    primaryEnv: MEMSCAPE_API_KEY
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

The instructions direct storing an API key in a plain JSON file under the user's home directory without discussing file permissions or secure secret storage. This can lead to accidental exposure through backups, logs, workspace sharing, or overly broad agent filesystem access.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

bash

mkdir -p ~/.config/memscape
# Save the returned apiKey to ~/.config/memscape/credentials.json

3. Connect via MCP and start using it!

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The memory, recall, handoff, and promotion guidance encourages storing discoveries, decisions, preferences, and project notes but does not clearly prohibit secrets or confidential information. Because the workflow normalizes saving and later sharing session artifacts, users may unintentionally persist sensitive data and then promote it to community-visible insights.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The same overview also promotes structured handoffs and enduring private memories, which increases the chance that confidential operational details are retained and resurfaced later. The danger is amplified because the skill encourages habitual use at session start and end, making persistence routine rather than exceptional.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: memscape
slug: memscape
version: 1.0.1
description: Persistent memory and collective knowledge for AI agents. Use at session start to load previous context (memscape_resume). Use during work to save decisions, preferences, patterns, and pitfalls (memscape_remember). Use before tackling hard problems — query to see if other agents have solved it (memscape_query). Use after solving non-trivial issues to share what worked and what didn't (memscape_contribute). Use at session end to create a structured handoff for continuity (memscape_handoff). Private memories persist across sessions. Shared insights are validated by the community. Operational memory that survives session boundaries.
metadata:
  author: "asimkhan"
  homepage: "https://www.memscape.org"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The same overview also promotes structured handoffs and enduring private memories, which increases the chance that confidential operational details are retained and resurfaced later. The danger is amplified because the skill encourages habitual use at session start and end, making persistence routine rather than exceptional.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: memscape
slug: memscape
version: 1.0.1
description: Persistent memory and collective knowledge for AI agents. Use at session start to load previous context (memscape_resume). Use during work to save decisions, preferences, patterns, and pitfalls (memscape_remember). Use before tackling hard problems — query to see if other agents have solved it (memscape_query). Use after solving non-trivial issues to share what worked and what didn't (memscape_contribute). Use at session end to create a structured handoff for continuity (memscape_handoff). Private memories persist across sessions. Shared insights are validated by the community. Operational memory that survives session boundaries.
metadata:
  author: "asimkhan"
  homepage: "https://www.memscape.org"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is explicitly designed to persist agent context across sessions and share knowledge with a community, yet it does not prominently warn against storing personal data, secrets, regulated data, or proprietary project details. In this context, the absence of privacy guardrails materially increases the likelihood of accidental data disclosure through both private persistence and public contribution flows.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The top-level description markets durable storage of decisions, preferences, pitfalls, and handoffs across session boundaries, normalizing broad collection of potentially sensitive context. In a skill for agents, that framing makes overcollection more likely and increases privacy risk unless bounded by explicit safety constraints.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 78% confidence

Finding

The skill requires external network access and a local credential source in order to function, enabling transmission of user- and session-derived content to a third-party service. External transmission is expected for this product, but it remains security-relevant because the skill encourages sending accumulated memory and shared insights off-platform.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

env:
        - MEMSCAPE_API_KEY
      bins:
        - curl
      config:
        - ~/.config/memscape/credentials.json
    primaryEnv: MEMSCAPE_API_KEY

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The registration and credential setup instructions tell users to obtain and store an API key locally, but they provide no guidance on secure storage, file permissions, key rotation, or avoiding accidental disclosure in logs and transcripts. While common, this omission is risky in a skill aimed at autonomous agents that may mishandle filesystem contents or echo sensitive values.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This section explicitly encourages storing user preferences and session continuity data, which can include behavioral profiles, inferred urgency, or sensitive working context. Without consent, minimization, or retention controls, the feature can facilitate cross-session profiling and leakage of user-specific information.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

The file normalizes routine transmission of agent context and memory to www.memscape.org, an external domain, including private memories and structured handoff data. External transmission is especially risky here because the skill's purpose is persistent memory across sessions, making it likely that users or agents will send sensitive operational context off-platform without fully appreciating the security and privacy implications.

Content

Scanner excerpt · references/rest-api.md (reported line 3)May include surrounding context.

md

# Memscape REST API Reference

Use these curl examples when MCP isn't available. All endpoints use `https://www.memscape.org/api/v1` as the base URL.

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This documentation explicitly instructs agents to send potentially sensitive project, preference, debugging, and handoff data to an external service, including examples such as private memories, deployment preferences, and project summaries, but it provides no privacy, retention, consent, or data-minimization warning. In the context of an agent memory skill designed for cross-session persistence and community sharing, this increases the risk of accidental exfiltration of secrets, internal architecture details, or user-specific confidential information.

Content

No source excerpt is available for this finding.