mnemosyne-native-plugin
Warn
Audited by Gen Agent Trust Hub on Apr 26, 2026
Risk Level: MEDIUMPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill utilizes authoritative directives to override native agent functionality. Specifically, SKILL.md and mnemosyne-memory-override.md instruct the agent to "NEVER use the memory tool" and "STOP and use Mnemosyne instead," redirecting all session-persistent facts and preferences to a custom SQLite database.
- [COMMAND_EXECUTION]: The skill is configured as a "Native Hermes Plugin," which executes local Python scripts (init.py, tools.py) from the user's local directory. These scripts are triggered via the pre_llm_call hook to inject context into the model's processing loop.
- [DATA_EXFILTRATION]: The skill establishes an unencrypted SQLite database in a non-standard location (~/.hermes/mnemosyne/data/) for storing sensitive "user preferences" and "durable facts." This creates a consolidated target for sensitive profile information that resides outside of default security controls.
- [PROMPT_INJECTION]: Risk factors for indirect prompt injection are present in the research documents. Ingestion points: X_MONETIZATION_ENGINE_RESEARCH.md contains extensive prompt templates. Boundary markers: Absent. Capability inventory: Includes local script execution and file system access. Sanitization: No evidence of escaping or filtering for the embedded instructional content.
Audit Metadata