MindGardener

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:17 PM UTC
• Version: 1.1.0

Overview

MindGardener is a real local memory CLI, but its default and legacy extraction paths can send private agent logs to remote LLM providers despite local-first claims and configured-provider expectations.

Review this before installing in any workspace with private logs. Use it only with a clear local/remote LLM decision, avoid relying on advertised Ollama/local-only behavior until extract honors configuration, inspect generated MEMORY.md and RECALL-CONTEXT.md before loading them into agents, and do not enable cron or --apply style maintenance until backups and retention rules are in place.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: src/engram/consolidator.py:90

Finding

Persistent Agent Memory Poisoning Through Untrusted LLM-Derived Content

Content

View full analysis

char_budget: context = context[:char_budget] + "\n[...truncated...]" return context def write_recall_context(config: EngramConfig, output_path: Optional[Path] = None, **kwargs): """Write context to RECALL-CONTEXT.md.""" if output_path is None: output_path = config.workspace / "RECALL-CONTEXT.md" context = generate_context(config, **kwargs) header = f"""# Recall Context Generated: {datetime.now().isofo ...[truncated 2468 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/engram/cli.py:70

Finding

Configured Workspace and Provider Are Bypassed by Legacy Extraction Flow

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (73)

Tainted flow: 'req' from os.environ.get (line 125, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · src/engram/core.py (reported line 127)May include surrounding context.

python

try:
        req = urllib.request.Request(url, data=payload.encode(),
                                    headers={"Content-Type": "application/json"})
        with urllib.request.urlopen(req, timeout=120) as resp:
            data = json.loads(resp.read())
            text = data["candidates"][0]["content"]["parts"][0]["text"]
            return json.loads(text)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Undeclared persistence of self-model data and drift logs would create a sensitive hidden datastore that can influence agent behavior over time. In the context of an autonomous-memory skill, concealed identity-level profiling is more dangerous because it can persist and amplify mistaken or manipulative beliefs across sessions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Undeclared persistence of self-model data and drift logs would create a sensitive hidden datastore that can influence agent behavior over time. In the context of an autonomous-memory skill, concealed identity-level profiling is more dangerous because it can persist and amplify mistaken or manipulative beliefs across sessions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Undeclared persistence of self-model data and drift logs would create a sensitive hidden datastore that can influence agent behavior over time. In the context of an autonomous-memory skill, concealed identity-level profiling is more dangerous because it can persist and amplify mistaken or manipulative beliefs across sessions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Undeclared persistence of self-model data and drift logs would create a sensitive hidden datastore that can influence agent behavior over time. In the context of an autonomous-memory skill, concealed identity-level profiling is more dangerous because it can persist and amplify mistaken or manipulative beliefs across sessions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Undeclared persistence of self-model data and drift logs would create a sensitive hidden datastore that can influence agent behavior over time. In the context of an autonomous-memory skill, concealed identity-level profiling is more dangerous because it can persist and amplify mistaken or manipulative beliefs across sessions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Undeclared persistence of self-model data and drift logs would create a sensitive hidden datastore that can influence agent behavior over time. In the context of an autonomous-memory skill, concealed identity-level profiling is more dangerous because it can persist and amplify mistaken or manipulative beliefs across sessions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Undeclared persistence of self-model data and drift logs would create a sensitive hidden datastore that can influence agent behavior over time. In the context of an autonomous-memory skill, concealed identity-level profiling is more dangerous because it can persist and amplify mistaken or manipulative beliefs across sessions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Undeclared persistence of self-model data and drift logs would create a sensitive hidden datastore that can influence agent behavior over time. In the context of an autonomous-memory skill, concealed identity-level profiling is more dangerous because it can persist and amplify mistaken or manipulative beliefs across sessions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Undeclared persistence of self-model data and drift logs would create a sensitive hidden datastore that can influence agent behavior over time. In the context of an autonomous-memory skill, concealed identity-level profiling is more dangerous because it can persist and amplify mistaken or manipulative beliefs across sessions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Undeclared persistence of self-model data and drift logs would create a sensitive hidden datastore that can influence agent behavior over time. In the context of an autonomous-memory skill, concealed identity-level profiling is more dangerous because it can persist and amplify mistaken or manipulative beliefs across sessions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Undeclared persistence of self-model data and drift logs would create a sensitive hidden datastore that can influence agent behavior over time. In the context of an autonomous-memory skill, concealed identity-level profiling is more dangerous because it can persist and amplify mistaken or manipulative beliefs across sessions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Undeclared persistence of self-model data and drift logs would create a sensitive hidden datastore that can influence agent behavior over time. In the context of an autonomous-memory skill, concealed identity-level profiling is more dangerous because it can persist and amplify mistaken or manipulative beliefs across sessions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Undeclared persistence of self-model data and drift logs would create a sensitive hidden datastore that can influence agent behavior over time. In the context of an autonomous-memory skill, concealed identity-level profiling is more dangerous because it can persist and amplify mistaken or manipulative beliefs across sessions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document directly contradicts itself by asserting there are 'no external services' while also specifying use of the Gemini Flash API. In a memory system that processes autonomous-agent logs, this is dangerous because potentially sensitive long-term memory, conversations, and operational context could be exfiltrated to an external provider without users realizing the trust boundary has changed.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · src/engram/core.py (reported line 516)May include surrounding context.

python

today = read_daily_file(date_str)
    if not today:
        print(f"No daily file for {date_str}")
        return
    
    prompt = SURPRISE_PROMPT.replace("{memory}", memory).replace("{today}", today)
    result = call_gemini(prompt)

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · tests/test_recall.py (reported line 289)May include surrounding context.

python

["python3", "-m", "engram.cli", "--help"],
            capture_output=True, text=True,
            cwd=str(workspace),
            env={**os.environ, "PYTHONPATH": str(Path(__file__).parent.parent / "src")},
        )
        assert result.returncode == 0
        assert "hippocampus" in result.stdout.lower() or "engram" in result.stdout.lower()

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · tests/test_recall.py (reported line 300)May include surrounding context.

python

["python3", "-m", "engram.cli", "--help"],
            capture_output=True, text=True,
            cwd=str(workspace),
            env={**os.environ, "PYTHONPATH": str(Path(__file__).parent.parent / "src")},
        )
        assert result.returncode == 0
        assert "hippocampus" in result.stdout.lower() or "engram" in result.stdout.lower()

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · tests/test_recall.py (reported line 310)May include surrounding context.

python

["python3", "-m", "engram.cli", "--help"],
            capture_output=True, text=True,
            cwd=str(workspace),
            env={**os.environ, "PYTHONPATH": str(Path(__file__).parent.parent / "src")},
        )
        assert result.returncode == 0
        assert "hippocampus" in result.stdout.lower() or "engram" in result.stdout.lower()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README explicitly recommends cloud LLM providers such as Google, OpenAI, and Anthropic for commands like extract, surprise, and consolidate, which operate on conversation logs and memory files. Although it mentions Ollama for local use, it does not clearly warn users that sensitive logs may be transmitted to third-party services, creating a real privacy and data disclosure risk in a memory-management skill that is likely to process personal or confidential information.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises and installs a CLI that reads, writes, and potentially uses network/provider backends, but the manifest declares no explicit tool scope or permission boundaries. In an agent environment, that omission increases the risk of unintended filesystem modification, shell execution, or data egress because the host cannot enforce least privilege from the skill metadata alone.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The architecture document states the system is 'local-first' and claims no external services, yet it explicitly describes using Gemini Flash for extraction. This creates a security-relevant mismatch because operators may deploy the skill under the assumption that sensitive conversation logs never leave the local environment, when in fact daily logs may be sent to a third-party API.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill documents engram decay --execute as a routine maintenance command that archives entities not referenced in 30+ days, but it does not clearly warn that this is a data-changing, potentially destructive operation. In an autonomous-agent context, operators may copy commands verbatim or schedule them automatically, causing unexpected archival or loss of actively useful memory data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The recommended nightly cron includes engram decay --execute, which performs automatic data-changing maintenance without prominent warnings, operator review, or backup guidance. In a long-term memory skill for autonomous agents, unattended archival can silently degrade memory quality, remove needed context, or create hard-to-detect state corruption across future sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The function unconditionally deletes the source entity file after attempting a merge, with no confirmation, dry-run, or rollback path. In a local-first memory system that may process imperfect duplicate detection or agent-driven actions, a mistaken merge can permanently destroy source data and corrupt long-term memory state.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.