Security audit

Memory System

Security checks across malware telemetry and agentic risk

Overview

This markdown-only memory skill is coherent, but it asks agents to persist, retrieve, inject, merge, archive, and delete user memory across scopes without clear consent or rollback controls.

Review this before installing if you do not want an agent to create or reuse long-term memories automatically. It is not executable malware, but it can shape agent behavior around persistent user/project memory and deletion/merge maintenance; use it only with clear user confirmation rules and avoid storing secrets, credentials, regulated personal data, or sensitive project details.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger list includes very broad generic terms such as '知识管理'、'信息存储' and '上下文管理', which can cause the skill to activate in conversations that only loosely relate to memory. Unintended activation is risky here because the skill prescribes automatic memory writing and retrieval behavior, potentially affecting user data persistence without clear consent.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill explicitly describes automatic writing, retrieval, cleanup, merging, and archival of memory across cloud, local, and workspace layers, but does not provide a user-facing warning or consent model for persistence and deletion. This is dangerous because users may unknowingly have sensitive information stored, propagated across scopes, or deleted/modified by maintenance rules without informed approval.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The exemplar explicitly recommends long-term storage of user preferences and cross-project sharing, but does not mention user consent, data minimization, retention limits, or privacy warnings. In a memory-system skill, this omission is meaningful because it can normalize persistent collection and reuse of personal data beyond the user’s immediate expectation.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The exemplar explicitly recommends storing user preferences in Local Memory and sharing them across projects, but it does not mention obtaining user consent, providing notice, limiting retention, or allowing opt-out/deletion. In a memory-system skill, this omission is more dangerous because the document can normalize persistent cross-project profiling behavior and lead downstream implementations to collect and reuse personal preference data more broadly than users expect.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The exemplar instructs writing user preferences into memory and validating retrievability, but it does not mention consent, retention limits, sensitivity screening, or user impact from persistence. In a memory-system skill, this omission is more dangerous because the content is operational guidance for repeated storage behavior, which can normalize persistent collection of personal data without safeguards.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The exemplar explicitly instructs retrieval of user preferences from memory and use of that data to satisfy requests, but it provides no notice, consent boundary, or limitation on when personal memory may be accessed. In a memory-system skill, normalizing retrieval of user-level preference data without privacy safeguards can lead to inappropriate access, over-collection, or use of sensitive personal context beyond user expectations.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This section operationalizes context injection of retrieved memory into the active conversation without warning, approval checks, or sensitivity filtering. In the context of a long-term memory skill, injecting recalled personal data into live context increases the risk of unintended disclosure, privacy leakage, and propagation of stale or incorrect personal information into downstream responses.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This template instructs the agent to perform memory cleanup operations such as defining deletion criteria, executing cleanup, and confirming results, but it does not require user confirmation, backup, preview, or rollback before removing stored information. In a memory-management skill, that omission is dangerous because it can normalize destructive actions on potentially valuable or persistent data, leading to accidental loss of user context, preferences, or other retained information.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The document explicitly defines persistent memory write, retrieval-based context injection, cleanup, and archival workflows, but provides no user-consent, disclosure, retention, or deletion-safety guidance. In an agent skill, this can lead to silent persistence of sensitive user or project data, unsafe reinjection of prior content into future prompts, and destructive maintenance actions without user awareness.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The document defines persistent cloud/local/workspace memory tiers and later prescribes write, cleanup, merge, and archive operations, but it does not require user consent, retention limits, or safeguards for destructive changes. In a memory-management skill, this can lead to unintended storage of sensitive data or irreversible modification/deletion of user information if an implementing agent follows the methodology literally.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.