情感记忆助手

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:54 AM UTC
• Version: 1.0.0

Overview

This skill’s emotion tracking is coherent, but it persistently stores sensitive emotional history and message snippets in plaintext without clear consent, retention, deletion, or file-permission safeguards.

Install only if you are comfortable with the skill saving emotional classifications and short excerpts of processed messages on your machine. Prefer using it after adding explicit opt-in, a way to delete history, retention limits, and restrictive file permissions for ~/.memory/emotions/history.json.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: emotion_memory.py:14

Finding

Plaintext Persistence of Sensitive Conversation and Emotion Data

Content

View full analysis

Vulnerability Details

File Location: emotion_memory.py, lines 14 and 72–75; sensitive record construction occurs at lines 161–169
Vulnerability Type: Plaintext sensitive-data storage with insufficient access-control and retention safeguards
Risk Level: Medium

Vulnerable Code

python

STORAGE_FILE = os.path.expanduser("~/.memory/emotions/history.json")

python

def save_history(history: List[Dict]):
    """保存历史情绪记录"""
    os.makedirs(os.path.dirname(STORAGE_FILE), exist_ok=True)
    with open(STORAGE_FILE, 'w', encoding='utf-8') as f:
        json.dump(history, f, ensure_ascii=False, indent=2)

python

record = {
    "user_id": user_id,
    "timestamp": result["timestamp"],
    "emotion": result["emotion"],
    "score": result["score"],
    "keywords": result["keywords"],
    "context": message[:100],  # 记录上下文
    "last_care_time": last_care_time
}

Technical Analysis

Every invocation of detect_emotion stores a user identifier, inferred emotional state, matched keywords, and up to 100 characters of the user's message. The accumulated records are serialized as unencrypted JSON at a predictable path under the user's home directory.

The implementation does not explicitly create the directory with mode 0700 or the file with mode 0600; effective permissions therefore depend on the process environment and umask. It also provides no retention limit, deletion mechanism, encryption, or option to disable storage of raw conversation context. Because emotional profiles and conversation excerpts can constitute sensitive personal information, these omissions create an avoidable local disclosure risk.

Attack Path

1. A user or integrating agent invokes detect_emotion with a message containing private information.
2. The function copies the first 100 characters of that message, along with the inferred emotion and user identifier, into a history record.
3. save_history writes the entire accumulated history to `~/.memor ...[truncated 1146 chars]

Remediation

View remediation

Remediation Suggestions

1. Minimize collected data

   • Do not store raw message context by default.
   • Persist only fields strictly required for the feature, such as the emotion category and timestamp.
   • Make conversation-excerpt storage explicitly opt-in.

2. Enforce restrictive permissions

   • Create ~/.memory/emotions with owner-only mode 0700.
   • Create the history file with mode 0600, rather than relying on the ambient umask.
   • Verify and correct permissions when loading existing storage.

3. Protect data at rest

   • Where confidentiality is required, encrypt records using credentials managed by an operating-system keychain or equivalent secure storage.
   • Do not hardcode encryption keys in the skill.

4. Implement lifecycle controls

   • Add a configurable retention period and automatic pruning.
   • Provide APIs to inspect, export, and permanently delete stored history.
   • Document what is collected, where it is stored, and how long it is retained.

5. Harden file updates

   • Write to an owner-only temporary file in the same protected directory.
   • Flush and atomically replace the destination to reduce corruption and unsafe partial updates.
   • Avoid following unexpected symbolic links where supported, and verify that the storage path is an expected regular file.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill indicates capabilities consistent with reading and writing files, including persistent storage of emotion history, but does not declare any tool scope or permissions boundaries. This creates an authorization transparency gap: a host or user cannot easily understand or restrict what the skill may access, increasing the risk of overbroad file access or silent persistence of sensitive data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest description and user-facing documentation are entirely in Chinese, and the emotion keyword library is defined only with Chinese terms. This indicates a language-specific constraint without an explicit user opt-in or explanation that the skill is intended only for Chinese-language use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill describes automatic proactive care messaging triggered by detected negative emotion, but it does not clearly disclose this autonomous behavior as a user warning or consent point. Undisclosed behavioral monitoring and intervention can be surprising, manipulative, or distressing, especially in a sensitive emotional-support context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill stores sensitive emotional history in a persistent local file but does not clearly warn users that their emotional state data will be retained. Emotion history is highly sensitive personal data, and undisclosed retention can violate user expectations, create privacy harm, and expose intimate behavioral patterns if the device or storage is compromised.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module description and all care/report messages are written in Chinese, with no mechanism to let the user choose language or confirm that Chinese is preferred. This creates a natural-language policy issue because the skill effectively forces one language for interaction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill persistently stores emotion classifications, matched keywords, timestamps, user IDs, and snippets of user messages in a local file under the user's home directory without any consent flow, retention limit, or access control. Emotional state and contextual snippets are sensitive personal data, so silent persistence increases privacy risk if the host is shared, backed up, synced, or later accessed by other tools.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill stores up to 100 characters of user message context along with emotion history, then exposes recent records and weekly summaries through recall functions. This creates a built-in retention and disclosure path for sensitive free-form user content, including financial stress, mental health indicators, or other private details, especially if another component can invoke these functions for the same user ID.

Content

No source excerpt is available for this finding.