Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed local knowledge-graph memory skill; it persists structured notes and models credential references but does not access secrets or install executable code.
Install only if you want an agent to maintain a persistent local structured memory file. Keep writes explicit, review what is stored in the JSONL graph, and use placeholder secret references rather than real passwords, tokens, API keys, or recovery material.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
forbidden_properties: [password, secret, token, key, api_key] properties: service: string secret_ref: string # Reference to secret store (e.g., "keychain:github-token") expires: datetime? scope: string[]?
The activation guidance uses very broad natural-language triggers such as 'Remember that...' and 'What do I know about X?', which can match ordinary conversation and cause the skill to activate outside its intended scope. In an agent-memory skill, unintended activation can lead to unnecessary persistence, relation creation, or retrieval of structured memory when the user did not explicitly request use of the knowledge graph.
The manifest describes a typed knowledge graph for structured agent memory with entities, relations, and constraints, but this schema explicitly models accounts, devices, and credentials, including secret-store references. While still data modeling rather than secret access, these capability definitions extend the skill into sensitive resource and credential inventory management that is not clearly justified by the manifest's narrow storage-focused description.
The title and story text are presented in Chinese while other sections are in English, but the document does not state that the skill is intended for Chinese-speaking users or provide a language/locale choice. This can violate language/locale policy expectations when a skill implicitly forces a language without user opt-in.