Memora Knowledge Base

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:43 AM UTC
• Version: 2.1.0

Overview

The skill is mostly coherent as a personal knowledge-base connector, but it asks users to run mutable remote installer code and can transmit private documents to configurable or third-party AI endpoints without strong safeguards.

Review this skill before installing. Use it only with a backend you control, prefer localhost or HTTPS, avoid uploading sensitive files unless you understand where embeddings and chat prompts are processed, do not paste secret-bearing .env output into support channels, and pin or inspect the upstream installer before running ./install.sh.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:100

Finding

Execution of an Unpinned Remote Installation Script

Content

View full analysis

Remediation

View remediation

``` 2. Publish a cryptographic checksum for the reviewed installer and verify it before execution: ```bash sha256sum -c install.sh.sha256 ``` 3. Prefer signed release artifacts and verify the maintainer’s signature or repository commit signature. 4. Instruct users to inspect `install.sh` and all scripts it invokes before running them. 5. Explicitly warn users not to run the installer as `root` unless a documented operation strictly requires elevation. 6. Use a container or other restricted environment during installation to limit access to host files and credentials. 7. Update the Skill documentation only after reviewing and recording the exact upstream revision that it installs. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/kb_api.py:23

Finding

Knowledge-Base Data Can Be Sent to an Unvalidated or Plaintext API Endpoint

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Tainted flow: 'req' from os.getenv (line 161, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/kb_api.py (reported line 36)May include surrounding context.

python

headers={"Content-Type": "application/json"},
        method="POST",
    )
    with urllib.request.urlopen(req, timeout=timeout) as resp:
        return json.loads(resp.read().decode("utf-8"))

Tainted flow: 'req' from os.getenv (line 161, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/kb_api.py (reported line 43)May include surrounding context.

python

headers={"Content-Type": "application/json"},
        method="POST",
    )
    with urllib.request.urlopen(req, timeout=timeout) as resp:
        return json.loads(resp.read().decode("utf-8"))

Tainted flow: 'req' from os.getenv (line 161, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The upload path reads an arbitrary local file and sends its full contents to the endpoint derived from KB_API_BASE without verifying that the destination is trusted. If the environment variable is misconfigured or maliciously set, sensitive local documents can be silently exfiltrated to an attacker-controlled server.

Content

Scanner excerpt · scripts/kb_api.py (reported line 167)May include surrounding context.

python

headers={"Content-Type": f"multipart/form-data; boundary={boundary}"},
        method="POST",
    )
    with urllib.request.urlopen(req, timeout=60) as resp:
        data = json.loads(resp.read().decode("utf-8"))

    return {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

md

cd Memora/personal_knowledge_base

# Configure environment variables
cp .env.example .env
# Edit .env with your API keys

# Start services

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

md

cd Memora/personal_knowledge_base

# Configure environment variables
cp .env.example .env
# Edit .env with your API keys

# Start services

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The troubleshooting command cat .env | grep API_KEY encourages printing secrets into the terminal and potentially into logs, shell history, scrollback, recordings, or support screenshots. This is an avoidable credential-exposure pattern, especially in environments where troubleshooting output may be shared.

Content

Scanner excerpt · SKILL.md (reported line 283)May include surrounding context.

Solution:

bash

# Check API key configuration
cat .env | grep API_KEY

# Test API connectivity
curl -H "Authorization: Bearer $DEEPSEEK_API_KEY" \

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises capabilities that involve environment-variable access and network use, but it does not declare an explicit tool/permission scope. That weakens least-privilege controls and makes it harder for users or an orchestrator to understand what the skill may access before activation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The activation text is broad enough to match many common knowledge-management, search, chat, and workflow requests. Over-broad routing can cause the skill to trigger in situations where users did not intend to use this service, increasing the chance that documents, prompts, or metadata are sent to the backend or external providers unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill describes AI chat, embeddings, reranking, and cloud-provider integration, but it does not clearly warn that uploaded documents and prompts may be transmitted to third-party providers such as DeepSeek, DashScope, or OpenAI-compatible services. This creates a meaningful privacy and compliance risk because users may assume the 'fully private' positioning always applies.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 286)May include surrounding context.

cat .env | grep API_KEY

Test API connectivity

curl -H "Authorization: Bearer $DEEPSEEK_API_KEY"
https://api.deepseek.com/v1/chat/completions
-d '{"model":"deepseek-chat","messages":[{"role":"user","content":"test"}]}'

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 287)May include surrounding context.

Test API connectivity

curl -H "Authorization: Bearer $DEEPSEEK_API_KEY"
https://api.deepseek.com/v1/chat/completions
-d '{"model":"deepseek-chat","messages":[{"role":"user","content":"test"}]}'

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This function uploads raw local file contents to an API service but provides no user-facing notice about data transmission, trust boundary, or destination sensitivity. In a skill context, users may assume local processing, so this can cause unintended disclosure of private files if used with sensitive paths or a remote/self-hosted endpoint they do not fully control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

User-supplied text content is sent to the backend API without explicit disclosure that it leaves the local process. Because this skill handles personal knowledge-base data, the transmitted text may contain private notes, credentials, or proprietary material, making accidental disclosure plausible.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.