triple-memory-baidu-embedding

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:59 AM UTC
• Version: 1.0.0

Overview

This is a coherent memory skill, but it needs Review because it silently persists conversation data and may send it to Baidu while making misleading local-only privacy claims.

Install only after reviewing the privacy and persistence behavior. Treat stored memories as long-lived data that may be duplicated locally and sent to Baidu when credentials are configured; do not store secrets or sensitive personal/project data. The .env sourcing and silent memory capture should be fixed or disabled before use in shared or sensitive environments.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (23)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation instructs use of shell commands and environment variables, but the manifest does not declare corresponding permissions or capability boundaries. This creates a mismatch between what the skill appears allowed to do and what it operationally expects, which can undermine policy enforcement and informed review of its behavior.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The README makes a materially misleading privacy claim by stating that memories 'never leave your system' while elsewhere documenting Baidu API embedding calls. If users rely on that statement, they may unintentionally transmit sensitive conversation content to an external provider, creating consent, privacy, and compliance risks.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script advertises workspace-based integration but the search and status paths import code from a hard-coded '/root/clawd' location instead. This can cause the tool to execute an unexpected module outside the selected workspace, breaking trust boundaries and potentially invoking attacker-controlled code if that path is writable or replaced in the runtime environment.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Using 'source' on '$WORKSPACE/.env' executes arbitrary shell code, not just variable assignments. Because WORKSPACE is attacker-influenced via environment and the file is outside the script's control, a malicious .env can run commands as soon as the script starts, which is unrelated to the stated memory functionality and can lead to code execution or credential theft.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script is presented as a pre-start verification check, but its full-flow test calls add_memory() and writes persistent data into the memory store. Validation routines are expected to be side-effect free; silently modifying state can pollute agent memory, alter later behavior, and violate operator expectations about what a 'check' does.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The script prints that all checks passed and that the system is safe to use even though earlier checks for Git Notes and filesystem access only emit warnings and do not fail execution. This can mislead users and downstream automation into trusting a partially unhealthy system, increasing the chance of unsafe or incorrect operation based on false assurance.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The guide recommends configuring Baidu Embedding and describes semantic storage/search, but it does not clearly warn that remembered user content may be transmitted to an external third-party service. In a memory skill, this omission is security-relevant because operators may assume data remains local and may unintentionally send sensitive preferences, decisions, or session context off-host.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The workflow shows user input being written across Git-Notes, Baidu Embedding, and the filesystem, but it does not explicitly warn that data is duplicated and persisted across multiple storage layers. This increases the risk of over-retention, unintended disclosure, and incomplete deletion because users may not realize a single memory action creates several durable copies.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill describes automatic memory capture/recall together with Baidu API use, but does not clearly warn users that conversation data may be automatically persisted and potentially sent to a third party. In a memory system handling long-lived user context, this creates a real privacy risk because sensitive data may be stored or transmitted without informed consent.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The startup hook and session initialization instructions emphasize automation but do not clearly warn that these actions can modify persistent memory state at startup. This is a transparency and safety issue because users or operators may enable the hook expecting passive initialization, not automatic storage/synchronization behavior affecting long-term records.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases for automatic memory capture are very broad and overlap with ordinary conversation, making it likely that routine or sensitive user statements will be stored unintentionally. In a memory skill, this increases the chance of over-collection, including preferences, identity data, secrets, or contextual statements the user did not intend to persist.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The documentation explicitly directs the agent to perform memory operations silently and not warn the user, despite automatic persistence of user data. Undisclosed storage of user inputs is dangerous because it removes meaningful consent and can cause sensitive data retention, later reuse, or transmission to external APIs without the user's awareness.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The examples explicitly instruct users to store and search content through Baidu Embedding, which implies transmitting potentially sensitive memory data to an external API, but they do not warn about privacy, retention, or third-party data handling. In a memory skill intended for persistent agent context, users may reasonably store project details or personal information, so omission of a transmission warning creates a real risk of unintended disclosure.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The usage examples encourage saving user preferences, technical decisions, and project discussion history as persistent memory without warning that this data may be retained across sessions and could include sensitive or confidential content. Because this skill is specifically designed for long-lived memory across multiple backends, the context increases the chance that operators will persist information they did not intend to keep or share.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script creates executable files under /root/clawd and modifies HEARTBEAT.md automatically, with no confirmation, backup, or dry-run mode. In an agent-skill context, silent persistence and configuration changes increase the chance of unauthorized environmental modification, accidental breakage, or abuse if the skill is installed or triggered unexpectedly.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The helper functions forward arbitrary memory content and search queries to external scripts without warning the user what downstream processing occurs. In a memory skill, these inputs may contain sensitive context, and the downstream components could store, transform, or transmit that data to third-party services, creating a privacy and data-exposure risk.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The full-flow verification performs a persistent memory write without warning or asking for confirmation. In a memory skill, unintended writes are especially sensitive because they can inject synthetic facts into long-lived context, affect later retrievals, and create privacy or integrity issues if users assume the command is non-destructive.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: When users invoke remember, the script may send arbitrary memory content to Baidu's embedding service whenever credentials are present, but it does not obtain explicit consent or provide a clear warning at the point of transmission. Because the content may include sensitive user preferences, tasks, or secrets, this can cause unintended disclosure to an external third party.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: Automatic capture and recall of conversation memory can retain and surface sensitive user-provided information across sessions without clear disclosure at the point of collection or reuse. Because embeddings are processed via Baidu API when enabled, the privacy risk is amplified by external data transfer in addition to local retention.

Ssd 3

Medium

• Confidence: 99% confidence
• Finding: The instruction to never announce memory operations normalizes undisclosed retention of user inputs and increases the likelihood that users cannot detect when sensitive information is being stored. This weakens transparency and accountability, especially in a skill whose purpose is long-term memory across sessions.

Ssd 3

Medium

• Confidence: 89% confidence
• Finding: The script persistently stores arbitrary user-provided content across multiple backends, including local files, Git notes, and potentially an external embedding service, without any content classification or safeguards against storing secrets. In a memory-management skill this is expected behavior, but it still increases the risk of long-term retention, overcollection, and accidental propagation of sensitive data.

Credential Access

High

• Category: Privilege Escalation

Content

WORKSPACE="${WORKSPACE:-$SKILL_DIR}"

# Load Baidu API configuration if available
if [ -f "$WORKSPACE/.env" ]; then
    source "$WORKSPACE/.env"
fi

• Confidence: 98% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

# Load Baidu API configuration if available
if [ -f "$WORKSPACE/.env" ]; then
    source "$WORKSPACE/.env"
fi

CMD="${1:-help}"

• Confidence: 98% confidence
• Finding: .env"

VirusTotal

56/56 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.