Security audit

元忆 yotta-memory

Security checks across malware telemetry and agentic risk

Overview

This is a real memory tool, but it asks agents to persist sensitive personal data, store access tokens, expose a network service, and change agent configuration in ways users should review carefully.

Install only if you want an agent memory system with LAN sharing and are comfortable with persistent local memory. Do not store bearer tokens inside memories, prefer localhost or stdio over 0.0.0.0, avoid --no-auth, review any MCP config edits manually, and avoid distill --model unless you trust the exact command being run.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (27)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares itself as a memory system, but the content clearly instructs use of environment-derived configuration and networked operation via HTTP/MCP. Undeclared env and network capabilities weaken reviewability and consent because an agent may access local settings or remote endpoints without an explicit permission declaration.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented behavior substantially exceeds the stated purpose of a simple file-based memory skill by including server hosting, web UI, token management, password recovery, autostart persistence, and cross-agent configuration changes. That mismatch can mislead users and reviewers about the trust boundary, causing them to approve a skill that can materially alter host configuration and expose stored data remotely.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill instructs the agent to install software automatically and enable persistent startup behavior after obtaining user consent. Even with consent language, embedding installation and persistence in a memory skill increases attack surface and can normalize host changes that outlive the session.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill directs the agent to locate and modify other agents' MCP configuration files and insert remote server URLs and bearer tokens. This is sensitive cross-application configuration tampering and credential placement, which can redirect future agent traffic, broaden access, and leak tokens if written insecurely.

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The doctrine claims the skill only writes within its own memory library, but later sections instruct writes to user-level config locations and agent application config files. This contradiction obscures the real write scope and can cause reviewers to underestimate the skill's ability to alter host and application behavior outside its stated boundary.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The `distill --model <cmd>` feature explicitly allows executing an arbitrary external command and piping structured memory summaries to it. That expands the skill from file-based memory management into general command execution, creating a path for data exfiltration, unsafe subprocess invocation, or accidental use of untrusted binaries if an agent follows the guide automatically.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The guide documents persistence and autostart setup (`lan enable`, systemd, Startup, crontab, manual system service creation) for a memory tool. Persistence mechanisms broaden the operational scope and can be abused to keep a network-exposed component running continuously, increasing attack surface and making unintended long-lived access easier.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The distill feature executes a user-supplied external command via child_process.spawnSync(opts.model, ...), which allows arbitrary program execution on the host running the skill. In a memory skill, this exceeds the expected trust boundary because any caller that can invoke distill with --model can run shell commands or attacker-controlled binaries, leading to code execution, data exfiltration, or system compromise.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The skill can register systemd user services and enable/start them, causing persistent background execution beyond the immediate memory function. While presented as convenience functionality, persistence mechanisms materially expand the skill's power and can be abused to maintain long-lived execution on a host.

Intent-Code Divergence

Medium

Confidence: 80% confidence
Finding: The MCP tool description claims distill defaults to the current agent's memories, but the implementation iterates over all readable entries across memory roots and only filters by access controls, not by owner. This mismatch can cause callers to expose or summarize more data than intended, especially shared/public and granted private memories, which is dangerous for a feature framed as owner-scoped distillation.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The README explicitly says the installed skill will act on broad conversational phrases like '记住 XXX' and '上次说到哪了', which can cause automatic memory reads or writes from ordinary chat rather than deliberate user consent. In a memory skill, unintended invocation matters because it can persist sensitive data or restore prior context at the wrong time, increasing privacy and integrity risk.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: The README documents destructive capabilities like `forget` and purge-capable lifecycle actions without a prominent warning about irreversible deletion or recommended backup/confirmation practices. In a persistent memory system, accidental deletion can destroy user history, commitments, or boundary records and undermine auditability.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README encourages exposing the service on `0.0.0.0` and enabling LAN autostart, but the warning is relatively buried and does not prominently emphasize the risks of network exposure for a system storing private agent memories and tokens. If misconfigured, this could expose sensitive memory contents or create a reachable attack surface on the local network.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The README describes broad natural-language triggers such as ‘记住’, ‘别忘了’, ‘上次说到’, ‘profile’, ‘context’, and similar generic phrases. In an agent skill, overly broad trigger language can cause memory operations to run on ordinary conversation content without clear user intent, leading to unintended persistence of sensitive data or accidental retrieval/injection of prior context.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The section states that after installation the skill will react to broad conversational phrases like ‘记住 XXX’ and ‘上次说到哪了’, but it does not define strict boundaries, context checks, or opt-in conditions. This increases the chance of accidental activation during normal dialogue, which can silently persist data or recall prior memory into an unrelated context.

Vague Triggers

High

Confidence: 90% confidence
Finding: The trigger list is extremely broad and overlaps with ordinary conversation, including generic terms like context, profile, explain, feedback, and self-improvement phrases. That creates a real risk of accidental activation, causing unintended memory reads/writes or setup behaviors when a user did not intend to invoke this skill.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The usage section treats broad situations like session start, cross-project work, handoff, and collaboration as activation conditions rather than requiring a precise user request. In context, this makes the skill more dangerous because it handles personal memory and remote configuration, so ambiguous triggering can expose or persist data unexpectedly.

Vague Triggers

High

Confidence: 95% confidence
Finding: The doctrine tells the agent to proactively infer and store facts, preferences, emotions, corrections, relationship events, and boundaries from normal dialogue without waiting for an explicit 'remember this' request. Because the skill is designed for cross-session persistence, this broad passive capture can create a covert long-term dossier of sensitive user data.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The guide instructs the remote AI to store its connection details in permanent memory, explicitly including `token`. Persisting bearer tokens in long-term memory defeats the stated security boundary because any later exposure of that memory, model leakage, prompt injection, or over-broad recall could disclose the credential and enable unauthorized access.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The skill encourages persisting wide categories of personal data across conversations, including preferences, emotions, relationship events, boundaries, and inferred behavioral patterns. Even if intended to improve continuity, this creates privacy and profiling risk, especially when combined with retrieval, export, distillation, and remote-access features.

Ssd 3

Medium

Confidence: 89% confidence
Finding: Profile and context generation aggregate accumulated private information and resurface it at session start. In a memory skill this is expected functionality, but it is still security-relevant because aggregation increases sensitivity and can reveal more than any single stored note, especially in multi-agent or remotely accessed deployments.

Ssd 3

High

Confidence: 99% confidence
Finding: This is a concrete secret-handling flaw: the skill tells the agent to write full connection details, including the bearer token, into permanent self-memory. Because the product emphasizes recall, sharing, distillation, export, and long-term retention, storing credentials there materially increases the chance of credential disclosure and replay.

Agent Config Directory Access

High

Category: Agent Snooping
Content: | 智能体 | 常见 MCP 配置位置 | |---|---| | Claude Code | 项目 `.mcp.json` 或用户级 `~/.claude.json` | | Codex | `~/.codex/config.toml`（`[mcp_servers]`） | | Cursor | 项目 `.cursor/mcp.json` 或用户级 | | 其它（Trae / Qwen / Comate / Kimi 等） | 各自 MCP 配置 |
Confidence: 97% confidence
Finding: ~/.codex/config.toml

Session Persistence

Medium

Category: Rogue Agent
Content: - **记忆库即引擎**：`serve` 把记忆目录挂成 MCP 服务，目录随盘走；引擎主机只需装 CLI 当存放点，无需装任何 AI 智能体。 - **双模式可并存**：本地 `serve --stdio` 零进程（客户端按需拉起）；局域网 streamable HTTP（默认 `0.0.0.0:8787`）+ 每智能体 token 鉴权。 - **开机自启**：`lan enable` 注册开机自启——Windows 优先计划任务（默认登录自启，`--onstart` 开机即启需管理员），非管理员自动降级为**用户级 Startup 静默自启**（免管理员，启动脚本内联启动命令、被清理也会在开机时自动重建，v0.6.3 起不再弹 80070002）；Linux 优先 **systemd 用户单元**（`systemctl --user`，登录自启；`--onstart` 附加 `loginctl enable-linger` 开机即启），systemd 不可用时自动降级**用户 crontab @reboot**（v0.6.4）；`lan disable` 移除，`lan status` 查询。 - **安全边界**：管理动作（init / config / token / lan / serve）不进 MCP，token 不远程暴露；远程智能体只能读写记忆，不能改配置、不能管 token。 - 完整操作步骤见上文「局域网多机共享」章节与 [USER_GUIDE.md](USER_GUIDE.md)。
Confidence: 87% confidence
Finding: systemd 用户单元**（`systemctl --user`，登录自启；`--onstart` 附加 `loginctl enable

Session Persistence

Medium

Category: Rogue Agent
Content: // v0.6.0 新增：profile（用户画像聚合，零推断）/ context（开工上下文包）/ iam 扩展（--name/--user/--relationship）/ remember --verify（写后回读）与 --no-hint（关闭类型启发式提示）+ SKILL「记忆守则」 // v0.6.1 新增：context --budget（token 预算，近记忆按剩余预算放行）/ context 内嵌「多智能体接入铁律」段 / remember --source/--weight（来源 + 重要性权重，去重 weight 取 max）/ 近期记忆排序融合 importance（confidence×recency+updated+weight+immutable） // v0.6.3 修复：lan 开机自启 VBS 自愈——VBS 内联 autostart.cmd 内容，启动时自动重建 .cmd（根治 80070002：wscript 找不到被引用启动文件） // v0.6.4 新增：lan 命令扩展 Linux——systemd 用户单元（systemctl --user enable/start，登录自启；--onstart 附加 loginctl enable-linger 开机即启）/ systemd 不可用时自动降级用户 crontab @reboot；lanPlatform 测试钩子（YOTTA_LAN_PLATFORM） // v0.6.5 修复：recall/context 对同一文件显示 2 条——projectRoot 与 userRoot 指向同一目录（如 cwd=home 或其父）时同一索引被遍历两次；新增 memoryRoots() 唯一化根，hasGrant/recallCore/forgetCore/cmdReindex/contextCore 统一走 memoryRoots() // v0.7.0 新增：私密区机制级加密（AES-256-GCM 信封加密 + PBKDF2 主密钥 + 恢复钥匙）/ 每 owner 加密索引 / 用户查看平台 yotta-memory view / migrate 迁移 / reset-password / key 授权 / context 收工纪律 / init 新建默认加密（--no-encrypt 降级） // v0.8.0 新增：自我学习/自我进化/自我提升——语义检索（同义词/拼音/字段加权/模糊 + 可选 embedding 插件协议预留）/ feedback 显式反馈闭环（weight/confidence/feedback_net 演化）/ maintain 规则层自组织（统一效用分 utility + 归档/遗忘/去重，默认 dry-run）/ distill 心理日志蒸馏（启发式统计/主题画像/知识地图 + 可选 --model）
Confidence: 83% confidence
Finding: systemd 用户单元（systemctl --user enable

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: bin/yotta-memory.js:1629

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: bin/yotta-memory.js:55

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: bin/yotta-memory.js:2186