ecloud-mem0-memory-service

• Outcome: Review
• Latest audit: Jul 31, 2026 · 9:34 AM UTC
• Version: 1.0.3

Overview

This is a coherent self-hosted memory skill, but it has Review-level privacy and control concerns around broad automatic saving, local secret/config persistence, and destructive memory operations.

Review before installing. Use only with a mem0 server you trust, assume personal statements may be stored long term, avoid sharing secrets or sensitive data in memory prompts, keep the generated .env out of version control, and require explicit confirmation before using delete-all or saving sensitive personal details.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The skill is presented as a memory CRUD/search interface, but its documented behavior expands into local logging, connection testing, and writing configuration secrets to local files such as `.env`. That mismatch undermines informed consent and can expose sensitive infrastructure details or credentials beyond the user’s expected scope.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The instructions require persisting mem0 configuration details into local project files unrelated to the core memory CRUD function. Storing user IDs and server endpoints in general project documentation/rules files increases the chance of accidental disclosure, version control leakage, and cross-context reuse without need.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The documentation first prohibits writing user information to local Markdown files, then later mandates recording user configuration details locally. This contradiction is dangerous because it normalizes bypassing stated privacy guarantees and can trick operators into persisting identifiers and service metadata in unsafe locations.

Vague Triggers

High

• Confidence: 90% confidence
• Finding: The save trigger is so broad that many ordinary conversational statements could be captured as long-term memory without clear user intent or confirmation. In a memory skill, over-collection is especially risky because it can store sensitive personal data, plans, or transient remarks permanently and transmit them to an external service.

Vague Triggers

High

• Confidence: 91% confidence
• Finding: The mandatory invocation rule activates on broad classes of personal statements like name, age, city, job, preferences, and plans, which can cause unintended storage of routine conversation. Because the skill transmits data to a remote memory backend, accidental activation materially increases privacy and retention risk.

Missing User Warnings

High

• Confidence: 94% confidence
• Finding: The skill instructs the agent to collect a server address, user ID, and API key, then use them in commands, but does not require any meaningful warning about local handling, remote transmission, or secret exposure risk. Collecting credentials through normal chat and shell invocation without clear security guidance can lead to leakage in transcripts, logs, or command history.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The instructions require recording configuration details locally for future sessions without transparently warning the user that their identifiers and server information will persist on disk. Silent local persistence expands the exposure surface and can leak through shared workspaces, backups, or repository commits.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The manifest advertises long-term memory storage, semantic search, and full CRUD over user memories, but it does not clearly warn about persistence, retention, or handling of potentially sensitive personal data. Because this skill is explicitly triggered by statements like names, ages, and preferences, users may unknowingly provide personal information that is stored on a self-hosted backend without informed consent or clear privacy expectations.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The manifest exposes a bulk `delete_all` operation with only a brief caution note and no indication of confirmation, scoping safeguards, or recovery protections. If invoked accidentally or abusively, it could irreversibly erase a user's entire memory set, causing data loss and undermining trust in the memory system.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The CLI exposes destructive operations such as `delete` and especially `delete-all` without any confirmation, dry-run, or additional safety gate. In a memory-management skill handling persistent user data, accidental invocation, argument confusion, or automation mistakes can irreversibly erase memories and cause integrity/availability loss.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script persists the API key in plaintext to a local .env file and only prints a generic success message, without warning the user about the sensitivity of the secret or the risks of local storage. Although the file is created with mode 0600, plaintext secret storage still increases exposure through backups, accidental commits, host compromise, or later permission changes.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Persisting user identifiers and server details into local rule/project files for later reuse creates unnecessary durable storage of identity and infrastructure metadata. Even without the API key, this information can aid tracking, correlation, or targeted abuse if the files are exposed.

Ssd 3

Medium

• Confidence: 88% confidence
• Finding: Mandating storage of the user's complete original utterance encourages wholesale retention of unnecessary or highly sensitive content, rather than minimized structured memory. In a long-term memory service, this increases privacy risk and may preserve incidental secrets, health data, or other regulated information that did not need to be stored verbatim.

Static analysis

No suspicious patterns detected.