memovault
Sink knowledge into a local Obsidian vault with bash. Use when the user wants to capture, save, record, or sink knowledge, notes, learnings, decisions, meeting takeaways, code snippets, CLI commands, or research into their memo vault / second brain / Obsidian knowledge base; or to create, edit, l...
Install this skill
or
85/100
Security score
The memovault skill was audited on Sep 9, 2026 and we found 3 security issues across 1 threat category. Review the findings below before installing.
Categories Tested
Security Issues
medium line 20
Access to home directory dotfiles
SourceSKILL.md
| 18 | |
| 19 | - No emoji anywhere in output, filenames, note content, or frontmatter. |
| 20 | - Never write outside the vault (`$AGENT_MEMO_VAULT`, default `~/.agent-memo-vault`). |
| 21 | - Always run preflight before the first vault operation in a session. |
| 22 | - Heat values are exactly one of: `seedling`, `growing`, `evergreen`. |
medium line 29
Access to home directory dotfiles
SourceSKILL.md
| 27 | |
| 28 | The skill ships a helper script. After install it lives at |
| 29 | `~/.agents/skills/memovault/scripts/memovault.sh`. In this repo it is at |
| 30 | `scripts/memovault.sh`. |
| 31 |
medium line 48
Access to home directory dotfiles
SourceSKILL.md
| 46 | Everything below assumes `$MM` points at the helper and `$AGENT_MEMO_VAULT` is set. |
| 47 | |
| 48 | The helper sources `env.sh` (`~/.agents/skills/memovault/env.sh`) at startup, so |
| 49 | variables pinned there apply to every caller without each agent exporting them. |
| 50 | `install.sh --force-fs` is a no-op kept for backward compatibility; the runtime |
Scanned on Sep 9, 2026
View Security Dashboard