Viking Memory System Ultra 2

• Outcome: Review
• Latest audit: May 28, 2026 · 8:14 AM UTC
• Version: 0.0.1

Overview

This memory skill has coherent local memory features, but it can silently send memory contents to third-party LLM APIs using embedded credentials and can write or move persistent files in broad locations.

Review carefully before installing. Do not use this version with secrets, private business notes, or sensitive personal memory data unless you are comfortable with that data being sent to MiniMax and NVIDIA LLM services. Prefer a revised version that removes embedded API keys, requires user-supplied credentials, makes remote LLM use opt-in, confines writes to the memory workspace, and clearly documents shared-memory sync and file-moving behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (29)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This finding describes materially undisclosed behavior: embedded third-party API credentials, outbound transmission of memory contents/queries to external LLM providers, and an extra sync pathway not documented in the skill description. In a memory-management skill, hidden network exfiltration and hardcoded secrets are especially dangerous because the data handled is likely user memory/context, which may include sensitive information.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The function reads memory content from a file and sends it to a third-party LLM endpoint over the network, while the skill metadata describes a memory system and does not disclose external transmission. Because this skill is explicitly handling memory data, the content may include sensitive user information, making undisclosed exfiltration to a remote provider a significant privacy and security risk.

Context-Inappropriate Capability

High

• Confidence: 100% confidence
• Finding: A hardcoded API key is embedded directly in the script, which exposes credentials to anyone who can read the skill and enables unauthorized use of the vendor account. In addition, the script depends on an external API for core memory operations without clear justification or disclosure, compounding both secret-management and data-exposure risks.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The script reads memory file content and embeds it directly into a prompt sent to a third-party LLM endpoint. In a memory-management skill, these files may contain sensitive user notes, credentials, or personal context, and the manifest description does not disclose this off-device transmission, creating a serious confidentiality and consent issue.

Context-Inappropriate Capability

Critical

• Confidence: 100% confidence
• Finding: A hardcoded bearer token for a third-party API is embedded directly in the script. Anyone with access to the skill can extract and abuse the credential, and the script also normalizes using a shared secret to exfiltrate user memory content to an external service.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The script is presented as an autoload/read operation, but it also modifies memory files by incrementing access_count during load. This hidden write side effect can surprise users, alter evidence/history, and trigger downstream behavior such as weight changes or later promotion logic, making 'read' operations non-idempotent.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: Beyond loading and displaying memories, the script performs write-side effects, optional weight updates, and optional promotion workflows that invoke other scripts. This broadens the trust boundary of a session-start helper and can cause unexpected state changes or disclosure of memory contents to additional processing stages.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The restore path claims to support restoring into different target layers, but the generated file metadata is hardcoded to `current_layer: L0` and `target_layer: hot`. This creates an integrity issue where downstream tooling may trust the metadata instead of the actual filesystem location, causing misclassification, incorrect promotion/archive behavior, or accidental exposure of content intended for a colder layer.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The script conditionally sources an external LLM interface and later uses it to perform semantic recall over matched memory contents. In a memory-management skill, this can expose local memory data to another component or remote model without strong trust boundaries, configuration validation, or explicit consent, making confidentiality risks real even if the feature is intended.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The awk parser claims to limit parsing to the frontmatter block, but because the same `/^---$/` rule appears twice, the first rule always matches and the parser never cleanly exits frontmatter mode. This can cause metadata extraction to read unintended content from the body, leading to incorrect layer/weight/importance handling and potentially leaking or misclassifying data during search output.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script embeds a live-looking NVIDIA API key directly in code and uses it to send memory content and task context to an external LLM endpoint. Hard-coded secrets are easily exfiltrated from source control or installed skills, and anyone with access to the file can reuse the credential and trigger unauthorized data transfer or billable API usage.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The script is named and documented as a read operation, but it performs in-place writes to the target file by updating `access_count` and `last_access`. In a memory/archive system, callers may reasonably treat read operations as side-effect free; this can unexpectedly alter evidence, break reproducibility, trigger write failures on protected files, or mutate files reached through attacker-influenced paths.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script can copy memory files from the local workspace into a separate global shared directory, which expands data exposure beyond the user's private memory area. In an agent skill context, this is dangerous because sensitive prompts, notes, credentials, or private operational state may be unintentionally propagated to other users or agents without access controls, consent checks, or content filtering.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script accepts arbitrary absolute paths and writes attacker-controlled content directly to them, which breaks the memory-system boundary and enables file overwrite anywhere the current user can write. In an agent environment, this can be abused to clobber shell configs, agent state, scripts, or application files, potentially causing persistence, denial of service, or execution of attacker-influenced content later.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README documents commands that write files and trigger automatic promotion behavior without warning users that these actions mutate persistent state. In a memory-management skill, silent or poorly documented state changes can lead to unintended data modification, promotion of sensitive content, or difficult-to-audit memory drift, especially if operators run examples verbatim.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The compression function uploads raw file contents to an external LLM service without any user-facing warning, consent flow, or manifest disclosure. Since a memory skill is likely to process notes, archives, and potentially private context, this creates a direct confidentiality risk through silent third-party disclosure.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Archived memory content is read and transmitted to an external API for recall generation without warning or consent. Archived data may contain long-lived, aggregated, or previously forgotten sensitive information, so sending it externally increases the impact of disclosure beyond a normal summary request.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The keyword extraction helper sends provided content to a third-party API without any warning to the user. Even if the output is only keywords, the full input still leaves the system boundary and may contain confidential text, credentials, or personal data.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The summarization function transmits the supplied content to an external service without disclosure. Summaries are often requested for arbitrary text, so this behavior can silently leak sensitive documents or memory contents to a third party.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The curl request transmits the full prompt, including user memory content, to an external LLM service without any user-facing warning or consent flow. Because this skill is specifically for memory storage and archival, the data is more likely than average to contain sensitive long-term context, making undisclosed disclosure especially risky.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The script uses a hardcoded API credential with no notice about credential sensitivity or handling expectations. This encourages insecure distribution of reusable secrets and increases the chance of unauthorized API use, billing abuse, and loss of control over downstream data processing.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script writes back to the underlying memory files without an explicit warning or confirmation, even during an operation users would reasonably expect to be passive. Silent mutation increases the risk of integrity issues, accidental repository churn, and unintended triggering of automated logic that depends on file metadata.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The promotion flow aggregates snippets from loaded memories into a natural-language context string and passes them to another script without clear disclosure at the point of use. Even if local, this expands exposure of prior memory content beyond simple display and may lead to over-sharing if the downstream script logs, transmits, or further processes that context.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Matched memory contents are piped into `llm_recall` with no user-facing warning, consent prompt, or indication whether the helper may call an external service. In this skill context, the searched data is explicitly a memory store and may contain sensitive user, project, or agent state, so silent transmission is especially dangerous.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The script uses an embedded API credential for outbound requests without warning users that their task context and memory contents may be transmitted to a third-party service. In a memory-management skill, this context can contain sensitive workspace notes, making silent transmission especially risky.

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.

Static analysis

No suspicious patterns detected.