persistia-claude-code-memory
Audited by Snyk on Jun 17, 2026
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 0.90). The skill explicitly instructs the agent to scan and read .env files and other credential sources into its persistent brain, which requires the LLM to access actual secret values (high risk of accidental verbatim exposure), even if runtime code references environment variables.
CRITICAL E005: Suspicious download URL detected in skill instructions.
- Suspicious download URL detected (high risk: 0.90). The raw GitHub URL points to a shell installer (setup.sh) hosted in an individual/unfamiliar repo and is intended to be curl|bash'd (direct executable that can read .env, git config and install persistent services), which is a high-risk distribution pattern; ara.so is just a short vendor site but does not mitigate the risk from the raw script.
CRITICAL E006: Malicious code pattern detected in skill scripts.
- Malicious code pattern detected (high risk: 0.90). The skill collects and persists sensitive credentials (reads .env, env vars, git/tool CLI config), runs autonomous scripts on a schedule, can push the brain repo to a remote GitHub repo, and is installed via a remote curl|bash — together these features create clear, high-risk vectors for credential theft, data exfiltration, and persistent remote abuse if misused or compromised.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 1.00). The installation step runs a remote shell script fetched and piped to bash (curl -fsSL https://raw.githubusercontent.com/bernardohcrocha/persistia-for-claude-code/main/setup.sh | bash), which executes remote code at setup time and is required for the skill to install—so the URL is a runtime-executed dependency.
MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).
- Direct money access detected (high risk: 1.00). The skill explicitly integrates with payment gateways (Stripe). The documentation shows reading Stripe credentials from .env/environment and includes concrete code/examples using the Stripe API (e.g., stripe.charges.list, stripe.subscriptions.list, and requiring process.env.STRIPE_SECRET_KEY), scheduled tasks that "Pull revenue, churn, new signups from Stripe," and sync scripts that interact with Stripe data. These are specific, direct integrations with a payment gateway API (not generic HTTP/browser/code execution), so it constitutes Direct Financial Execution capability.
MEDIUM W013: Attempt to modify system services in skill instructions.
- Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill instructs the agent to install a persistent agent (via curl | bash), create and manage scheduled services (launchd/systemd timers and service files) and modify the project/system filesystem for persistent, autonomous tasks — actions that change the machine's state and touch service configuration files (systemctl/launchd) which can require elevated privileges.
MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).
- Hidden Unicode characters detected (1 type(s) found)
Issues (7)
Insecure credential handling detected in skill instructions.
Suspicious download URL detected in skill instructions.
Malicious code pattern detected in skill scripts.
Unverifiable external dependency detected (runtime URL that controls agent).
Direct money access capability detected (payment gateways, crypto, banking).
Attempt to modify system services in skill instructions.
Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).