Memory Sync

• Outcome: Review
• Latest audit: Jun 28, 2026 · 1:41 PM UTC
• Version: 1.0.3

Overview

This skill is not clearly malicious, but it needs review because it can collect and persist broad local agent history, rules, configuration, and skill inventories into an Obsidian vault and optionally Git.

Install only if you intentionally want a local memory system with access to agent histories, rule files, profile/config files, and skill inventories. Keep the vault and any Git remote private, leave Git push disabled unless you have reviewed the staged files, avoid broad automatic triggers, and do not enable hard-delete or raw conversation scans unless you have confirmed the scope.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 98% confidence
• Finding: The skill explicitly instructs the agent to run local Python commands, read multiple local data stores, write large numbers of files into an Obsidian vault, inspect environment variables, and optionally perform git operations. Those are privileged behaviors, but the skill declares no permissions boundary or consent model, which increases the chance an agent platform will grant broad access implicitly or without clear user review. In this context the capability set is integral to the skill, but the undeclared scope is still a real security issue because it processes highly sensitive local memory and can stage or publish it.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill scans and copies broad local agent configuration and profile sources such as AGENTS.md, USER.md, config files, and related local state into the vault, exceeding the stated memory-sync scope. In a memory-preservation tool, this is dangerous because it can silently aggregate sensitive local instructions, preferences, and potentially secret-bearing config into a centralized, syncable repository.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The file embeds a large cross-domain skill-classification catalog unrelated to memory synchronization, despite the manifest saying the skill should not be used for code debugging or unrelated workflows. This scope expansion increases the amount of local capability metadata the skill collects and publishes, creating unnecessary privacy and overreach risk.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: Installed-skill discovery and publication of agent skill inventories is outside the described memory-sync purpose and enumerates local capabilities across multiple agents. That creates privacy and fingerprinting exposure, especially when outputs are later written into shared vault paths or synced with Git.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The skill reads and archives full multi-agent conversation stores from local JSONL, SQLite databases, and CLI exports for Codex, Claude, Hermes, OpenCode, and OpenClaw. In the context of a memory-sync tool, this is highly sensitive because it centralizes raw transcripts from multiple systems, potentially including credentials, personal data, code, and confidential instructions, and then stores readable copies in a vault that may later be synced.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The generic trigger template uses broad everyday phrases like memory, context, previous, and last time as automatic activation signals. Because the skill can read local archives and write persistent summaries, overbroad triggers can cause unintended collection, indexing, or retrieval of sensitive historical data during ordinary conversations where the user did not intend a memory operation. The danger is elevated here because the skill targets cross-agent memory stores and durable exports.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The OpenClaw example recommends automatic invocation on very common words and phrases in both Chinese and English without tight scope constraints. This can lead the agent to search or engage the memory layer unexpectedly, potentially exposing prior conversations, personal knowledge files, or other retained context when the user only used a common word casually. Given this skill's broad local data access, accidental activation is materially risky.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The default prompt is very broad and bundles many high-impact actions: syncing memory, importing candidates, maintaining stores, exporting context for multiple agents, searching indexes, and running Git sync. Combined with implicit invocation, this can cause the skill to trigger in loosely related contexts and perform data movement or export actions beyond the user's specific intent, increasing the risk of unintended disclosure or over-collection of sensitive memory data.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger list includes very broad, common words such as 'previous', 'context', 'history', and equivalents in multiple languages. In a memory-sync skill, this can cause the skill to activate during ordinary conversation and route user content into memory review/export flows unexpectedly, increasing the chance of unintended access, persistence, or sync of sensitive data.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The configuration hard-codes trigger words across several languages without any visible user-choice, locale detection, or opt-in mechanism. For a skill that handles durable memory across tools and optional Git sync, multilingual broad triggers expand the activation surface and may cause users to invoke sensitive memory operations unintentionally in languages they did not expect to be monitored.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Hard-delete mode can irreversibly remove files and directories in the vault without an interactive confirmation or a deletion-specific warning at the execution point. In a tool that auto-manages large memory and source trees, this creates a realistic risk of destructive data loss from misconfiguration, path mistakes, or unexpected cleanup behavior.

Persistent Context Injection

Medium

• Category: Memory Poisoning

Content

- Require strong keyword evidence for a match.
- Detect noisy single-trigger reinforcement and downgrade or remove weak memories.

To make an agent automatically query this memory layer when the user mentions memory-related words, install an agent rule in that agent's own persistent rule file. Do not assume every agent uses OpenClaw's rule structure.

Recommended rule entry points:

• Confidence: 91% confidence
• Finding: persistent rule

Persistent Context Injection

Medium

• Category: Memory Poisoning

Content

"codex": ["project AGENTS.md", "~/.codex/AGENTS.md"],
    "claude": ["project CLAUDE.md", "project .claude/CLAUDE.md", "~/.claude/CLAUDE.md"],
    "opencode": ["project AGENTS.md", "~/.config/opencode/AGENTS.md", "CLAUDE.md compatibility file when used"],
    "hermes-agent": ["configured system prompt or rule file", "Context/hermes-agent.md handoff when no persistent rule file exists"],
    "qoder": ["Qoder user/project rules when configured", "Context/qoder.md handoff when no persistent rule file exists"],
}
AGENTS_DIR = SOURCES_DIR

• Confidence: 87% confidence
• Finding: persistent rule

Persistent Context Injection

Medium

• Category: Memory Poisoning

Content

"claude": ["project CLAUDE.md", "project .claude/CLAUDE.md", "~/.claude/CLAUDE.md"],
    "opencode": ["project AGENTS.md", "~/.config/opencode/AGENTS.md", "CLAUDE.md compatibility file when used"],
    "hermes-agent": ["configured system prompt or rule file", "Context/hermes-agent.md handoff when no persistent rule file exists"],
    "qoder": ["Qoder user/project rules when configured", "Context/qoder.md handoff when no persistent rule file exists"],
}
AGENTS_DIR = SOURCES_DIR
SHARED_DIR = STATE_SHARED_DIR

• Confidence: 87% confidence
• Finding: persistent rule

Persistent Context Injection

Medium

• Category: Memory Poisoning

Content

lines.extend([
                "## Memory Retrieval Contract",
                "",
                f"- Install automatic memory-trigger rules in: {', '.join(entrypoints) if entrypoints else 'the agent persistent rule file'}.",
                "- Trigger words are activation signals; they do not make memory-sync run unless the agent rule explicitly calls it.",
                "- Search with the user's actual keyword phrase, not the full transcript.",
                "- If the agent has built-in memory/context search, combine it with memory-sync search before answering.",

• Confidence: 95% confidence
• Finding: persistent rule

Credential Access

High

• Category: Privilege Escalation

Content

os.environ.setdefault(key.strip(), value.strip().strip('"').strip("'"))


load_env(ROOT / ".env")


def default_hermes_home() -> str:

• Confidence: 96% confidence
• Finding: .env"

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.