ecloud-mem0-memory-service

• Outcome: Review
• Latest audit: Jul 29, 2026 · 3:43 AM UTC
• Version: 1.0.2

Overview

This memory skill is purpose-aligned, but it handles personal memories and credentials with broad automatic capture and weak disclosure/safeguards.

Review before installing. Use only with a mem0 server you trust, avoid HTTP except for local testing, do not provide highly sensitive information unless you intend it to be retained, and rotate the API key if the workspace or .env file may be shared. Be careful with delete-all because the implementation has no built-in confirmation barrier.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The skill first prohibits storing user information in local Markdown files, then later instructs the agent to record configuration details in local files such as `AGENTS.md`. This contradictory guidance can lead to accidental local persistence of user identifiers and service endpoints, undermining the stated privacy boundary and increasing the chance of sensitive data being stored in repos or workspace files.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The skill claims that all memory operations must go through `memory.js`, but then requires separate local state tracking outside that mechanism. This creates an inconsistent control boundary, making it easy for implementations to bypass the intended storage path and leak user metadata into unmanaged local files.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill creates a persistent local log file and records memory-operation metadata, including request URLs, response snippets, and potentially user content via later debug logging paths. For a memory CRUD/search helper, this expands data exposure onto disk without clear necessity, increasing the chance that sensitive memory contents or identifiers are recoverable from the host filesystem.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The trigger conditions are broad enough to capture many ordinary personal statements and automatically store them as long-term memory. Without scope limits, confirmation rules, or sensitivity filtering, the skill can over-collect personal data that the user did not intend to persist externally.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The top-level description mandates use of the skill for very common phrases like names, age, preferences, and memory questions, with no contextual constraints. In a memory skill, that makes accidental invocation more likely and increases privacy risk because routine conversation may be sent to an external service unnecessarily.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill instructs the agent to collect an API key from the user and pass it on the command line, but provides no warning about credential sensitivity, masking, or secure handling. Command-line arguments may be exposed in shell history, logs, process listings, transcripts, or tool telemetry, causing credential leakage.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill directs the agent to send personal information to a self-hosted mem0 server as long-term memory, but does not disclose that data will be transmitted to an external service and retained. Users may reveal names, age, city, job, and preferences without informed consent, creating a significant privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The instructions require recording user configuration details such as user ID and server address in local files without warning about persistence or workspace exposure. Even if not full credentials, these identifiers can reveal account linkage and infrastructure details and may be committed, shared, or retained longer than intended.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The manifest presents a long-term memory system with semantic search and full CRUD capabilities, but it does not clearly warn users that information may be stored persistently and may include sensitive personal data. In a memory skill, this omission is risky because users are specifically encouraged to provide personal facts, increasing the chance of unintended retention of sensitive information without informed consent.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill exposes a bulk-delete operation for all user memories with only a brief caution note and no explicit requirement for irreversible-action confirmation. In a long-term memory service, accidental or manipulated invocation of this function could permanently erase all stored data for a user, making the context more dangerous because deletion targets the entire persistence layer.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The save path handles arbitrary user message content and sends it to a remote memory service, while other parts of the request layer may log request bodies and responses locally. Because long-term memory often contains highly sensitive personal data, storing and transmitting it without explicit consent boundaries, redaction, or privacy controls creates a meaningful confidentiality risk.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The delete-all operation irreversibly removes all memories for the configured user and is exposed without any confirmation, dry-run, or secondary safeguard. In an agent context, accidental invocation, prompt manipulation, or misuse could cause total loss of long-term memory state.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script writes the supplied API key and other configuration directly into a local .env file, but it does not clearly warn the user that a long-lived secret is being persisted on disk. Even with mode 0600, local secret storage can still expose credentials through backups, accidental commits, shared environments, or later permission changes, so the issue is a real security weakness rather than just a UX concern.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The connection test sends user-supplied server URL, user ID, and API key to the target service immediately after parsing them, but the script does not clearly disclose what information will be transmitted. This can cause users to unknowingly send credentials to an untrusted or mistyped endpoint, especially because plain HTTP is allowed by validateBaseUrl.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The skill requires collecting user credentials and persisting configuration identifiers for future sessions, expanding the amount of sensitive operational and personal data handled by the agent. This increases the attack surface through local persistence, transcript exposure, and potential misuse of the supplied API key.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill mandates storing users' complete original statements as long-term memory, including personal details and updates, rather than extracting only the minimum necessary facts. This can capture excess context, sensitive information, and incidental data that the user did not intend to retain, raising privacy and data minimization concerns.

Credential Access

High

• Category: Privilege Escalation

Content

}

function saveToEnvFile(config) {
    const envPath = path.join(__dirname, '..', '.env');

    const content = `# mem0 记忆服务配置
# 生成时间: ${new Date().toISOString()}

• Confidence: 93% confidence
• Finding: .env'

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.