Security audit
Security checks for vulnerabilities and agentic risk
The skill has a coherent memory-service purpose, but the packaged app has serious authentication, secret-management, and reputation-data integrity risks that need review before installation.
Install only after reviewing the deployment code and controls. Set a strong JWT_SECRET, rotate the committed ACP key, remove shell-injection-prone sync scripts or make them safe, require verified wallet authentication on reputation mutations, disclose OpenAI/Qdrant processing, and avoid storing secrets, wallet seeds, tokens, regulated personal data, or confidential material in memories or shared pools.
src/lib/auth.ts:5Predictable JWT Fallback Secret Enables Session Forgery
scripts/sync-acp-agents.ts:67Shell Command Injection Through ACP Search Arguments
scripts/sync-all-acp-agents.ts:14ACP API Credential Committed in Source Code
src/app/api/reputation/transaction/route.ts:11Unauthenticated Reputation Transactions and Reports Permit Arbitrary Trust Manipulation
src/lib/auth.ts:83Replayable Wallet Authentication Accepts Arbitrarily Future Timestamps
src/lib/embeddings.ts:14Plaintext Memories and Recall Queries Are Disclosed to External Data Processors
Memory deletion is a legitimate feature, but exposing it in an agent skill increases the risk of prompt-induced or accidental manipulation of long-term memory. An attacker or misleading instruction could cause selective deletion of important records, undermining integrity and continuity.
// List memories
GET /api/memory/list?type=preference&limit=20
// Delete memory
DELETE /api/memory/{id}
// Export all memories
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
GET /api/memory/list?type=preference&limit=20
// Delete memory
DELETE /api/memory/{id}
// Export all memories
GET /api/memory/export
A vault-wide DELETE operation is a highly destructive capability, and the documentation presents it without meaningful safety constraints or human-in-the-loop confirmation. In an agent environment, a single induced tool call could wipe all long-term memory, causing irreversible denial of service against the agent's knowledge base.
GET /api/memory/export
// Clear vault DELETE /api/memory/vault
---
The API reference includes deletion and vault-clearing endpoints that can alter or erase long-term memory, making integrity attacks feasible if the agent can be induced to call them. In this context, persistent memory is central to agent behavior, so destructive manipulation has outsized operational impact.
| POST | `/memory/recall` | Semantic search memories |
| GET | `/memory/list` | List memories |
| GET | `/memory/{id}` | Get specific memory |
| DELETE | `/memory/{id}` | Delete memory |
| GET | `/memory/export` | Export all memories |
| DELETE | `/memory/vault` | Clear entire vault |
| GET | `/agent/stats` | Usage statistics |
The skill exposes direct memory deletion, which can be abused through prompt injection, mistaken automation, or malicious instructions to remove safety-relevant or user-important memories. Because agent memory influences future behavior, deletion can tamper with decision context, erase auditability, and undermine integrity.
Example:
Delete memory mem_abc123
The documented DELETE endpoints for individual memories and the entire vault expose destructive memory manipulation primitives at the API level. If invoked by an untrusted workflow, compromised agent, or weakly authorized integration, these endpoints could erase critical memory state at scale and disrupt agent behavior or evidence preservation.
| POST | `/memory/recall` | Semantic search |
| GET | `/memory/list` | List memories |
| GET | `/memory/{id}` | Get specific memory |
| DELETE | `/memory/{id}` | Delete memory |
| GET | `/memory/vault` | Export all |
| DELETE | `/memory/vault` | Clear vault |
| GET | `/agent/stats` | Usage stats |
ws 8.18.0 is a real vulnerable dependency with advisories for memory disclosure and memory-exhaustion denial of service, and this package is common in wallet, RPC, and realtime communication stacks present in this project. Because the skill includes multiple WebSocket-capable blockchain and wallet libraries, any exposed WebSocket client/server processing attacker-influenced frames could be abused to crash the process or leak memory contents.
ws 8.19.0 is likewise affected by the cited memory disclosure and fragmentation-based DoS issues, and here it appears in the Solana websocket subscription stack. If this skill uses blockchain subscription features or other ws-backed channels reachable by untrusted networks, attackers may be able to trigger resource exhaustion or potentially disclose uninitialized memory through malformed frames.
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
}
}
// DELETE memory
export async function DELETE(
request: NextRequest,
{ params }: { params: Promise<{ id: string }> }
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
},
})
} catch (error) {
console.error('Delete memory error:', error instanceof Error ? error.message : 'Unknown error')
return NextResponse.json(
{ success: false, error: 'Internal server error' },
{ status: 500 }
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
},
})
} catch (error) {
console.error('Delete memory error:', error instanceof Error ? error.message : 'Unknown error')
return NextResponse.json(
{ success: false, error: 'Internal server error' },
{ status: 500 }
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
},
})
} catch (error) {
console.error('Delete memory error:', error instanceof Error ? error.message : 'Unknown error')
return NextResponse.json(
{ success: false, error: 'Internal server error' },
{ status: 500 }
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
},
})
} catch (error) {
console.error('Delete memory error:', error instanceof Error ? error.message : 'Unknown error')
return NextResponse.json(
{ success: false, error: 'Internal server error' },
{ status: 500 }
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
// Rollback on error
setMemories((prev) => [memoryToDelete, ...prev])
if (stats) setStats({ ...stats, memoriesStored: stats.memoriesStored })
setError('Failed to delete memory')
}
} catch {
// Rollback on network error
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
// Rollback on error
setMemories((prev) => [memoryToDelete, ...prev])
if (stats) setStats({ ...stats, memoriesStored: stats.memoriesStored })
setError('Failed to delete memory')
}
} catch {
// Rollback on network error
The skill markets persistent memory for agents and gives examples of storing user preferences, but it does not clearly warn that this information is sent to an external service and retained across sessions. That creates a meaningful privacy and consent risk because agents may transmit sensitive user data off-platform without explicit user awareness or minimization guidance.
The skill explicitly encourages long-term retention of conversational preferences, project context, and prior interactions, but it provides no data minimization, sensitivity classification, or retention boundaries. This creates a natural path for agents to persist personal, confidential, or regulated data far beyond user expectations.
The phrase 'applies context without asking again' indicates autonomous reuse of prior memory without renewed user confirmation. In a memory system this can cause privacy surprises, stale-context misuse, or actions taken based on retained assumptions the user did not intend to persist.
---
The documentation exposes deletion and vault-clearing operations without prominently warning that these actions can permanently erase stored memory. In an agent setting, destructive actions may be triggered by misunderstanding, prompt injection, or operator error, causing irreversible loss of context and history.
The embedded SKILL instructions tell agents to store arbitrary information for later retrieval, including user preferences, with no privacy guardrails or approval checks. This makes unsafe retention behavior part of the intended workflow and increases the chance that agents will memorize sensitive user content automatically.
The skill markets persistent memory, export, and semantic recall capabilities without prominently warning users not to store secrets, personal data, or regulated information. This can lead agents to persist sensitive data and later expose it through recall or export features, increasing privacy and data leakage risk across sessions.
The cross-agent memory pool feature encourages sharing knowledge between agents but does not warn that pooled memories may contain sensitive, proprietary, or user-specific information. In practice, this can cause unintended disclosure of confidential context to other agents or operators with pool access.
Although overwrite mode is mentioned, the snapshot restore feature does not strongly warn that restoring in overwrite mode can replace current memory state and effectively rewrite the agent's retained knowledge. This creates integrity and safety risks, especially if an agent can be prompted into destructive state changes or loss of important context.
The documented history and reporting flows expose transaction metadata, counterparty identities, ratings, and feedback to an external service without any privacy notice, retention disclosure, or minimization guidance. In a reputation system, this data can be sensitive and linkable over time, creating deanonymization, profiling, and reputational harm risks if users submit it without understanding how it will be stored or shared.
The register and transaction endpoints collect identifying and transactional information and appear designed to persist it for future trust scoring, yet the documentation omits any warning that submissions may create a lasting public or semi-public reputation record. This can mislead integrators into sending data that affects identity, traceability, and trust outcomes without informed consent or operational safeguards.