Agent Migration Pack

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:01 AM UTC
• Version: 1.0.6

Overview

This migration skill has a coherent purpose, but its examples and packaging workflow can expose private memory, contacts, social graph, business, and investment data when shared.

Review and redact the example and generated files before installing or sharing this skill. Do not run the pack workflow on a public or distributable package unless EXAMPLES is removed or fully synthetic, avoid online validators for private migration JSON, and treat generated owner, memory, relations, and skill catalog files as sensitive plaintext exports.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/migrate.py:139

Finding

Private and third-party data is bundled into distributable archives

Content

View full analysis

Vulnerability Details

File Location: scripts/migrate.py:139-161; affected data includes EXAMPLES/xiaoyi-example/owner.json:3-33, EXAMPLES/xiaoyi-example/memory.json:5-93, and EXAMPLES/xiaoyi-example/relations.json:5-133
Vulnerability Type: Sensitive-data exposure through unsafe archive inclusion
Risk Level: High

Vulnerable Code

python

include_patterns = [
    "README.md",
    "MIGRATION-GUIDE.md",
    "CHANGES.md",
    "manifest.toml",
    "TEMPLATE/",
    "EXAMPLES/",
    "scripts/"
]

exclude_files = []

print(f"\nSource directory: {root_dir}")
print(f"Output file: {output_name}")

with zipfile.ZipFile(output_path, 'w', zipfile.ZIP_DEFLATED) as zipf:
    for pattern in include_patterns:
        full_path = root_dir / pattern
        if full_path.exists():
            if full_path.is_file():
                arcname = full_path.name
                zipf.write(full_path, arcname)
            else:
                for file_path in full_path.rglob("*"):
                    if file_path.is_file():
                        arcname = str(file_path.relative_to(root_dir))
                        if file_path.name not in exclude_files:
                            zipf.write(file_path, arcname)

The recursively included example files contain plaintext records marked as private or sensitive, including an owner's name, location, profession, family details, recurring schedule, business strategy, investment positions, third-party email addresses, relationship histories, and communication summaries.

Technical Analysis

The pack_zip() function uses a fixed inclusion list that contains the entire EXAMPLES/ directory. It then recursively archives every regular file because exclude_files is empty. There is no data classification enforcement, redaction, sensitive-data scan, user confirmation, or allowlist of approved example files.

This behavior conflicts with the se ...[truncated 1836 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all real personal and third-party information from the repository and replace it with clearly synthetic example data.
2. Exclude EXAMPLES/ from production archives by default.
3. If examples are needed, require an explicit option such as --include-examples.
4. Replace recursive directory inclusion with a strict allowlist of files selected for the current migration.
5. Add a pre-pack scan for email addresses, phone numbers, credentials, financial positions, schedules, and other personal data.
6. Block packaging when private or sensitive files are detected unless the user explicitly reviews and approves each file.
7. Display the final archive inventory and sensitivity classification before creating the ZIP.
8. Add automated tests confirming that private example files cannot enter default release archives.
9. Obtain consent before distributing any third-party contact or relationship information.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate-pack.py:115

Finding

Raw memory content is copied into migration output without secret detection

Content

View full analysis

Vulnerability Details

File Location: scripts/generate-pack.py:115-130
Vulnerability Type: Unredacted sensitive-memory extraction
Risk Level: Medium

Vulnerable Code

python

memory_file = self.find_file("MEMORY.md")

memory = {
    "template_version": self.VERSION,
    "file_type": "memory",
    "extracted_at": self.timestamp,
    "source_files": [],
    "data": {}
}

if memory_file:
    memory["source_files"].append(str(memory_file))
    content = self.read_text_file(memory_file)
    memory["data"]["_extracted_content"] = (
        content[:500] + "..." if len(content) > 500 else content
    )

Technical Analysis

The generator locates MEMORY.md in the current workspace, a data directory, or the configured base path. When found, it reads the file and copies its first 500 characters verbatim into MEMORY/core-memory.json.

No inspection is performed for credentials, API tokens, private keys, email addresses, personal identifiers, financial information, confidential business data, or instruction content. The output is plaintext and is intended to become part of a portable migration package.

Limiting extraction to 500 characters is not a security control. Secrets and private information often appear near the beginning of configuration or memory files. The extraction is also enabled by the normal generation workflow rather than by an explicit sensitive-data opt-in.

Attack Path

1. An Agent workspace contains a MEMORY.md file.
2. Sensitive information appears within its first 500 characters.
3. The user runs python scripts/generate-pack.py --output ./my-agent-pack.
4. The generator reads MEMORY.md and copies the content verbatim into MEMORY/core-memory.json.
5. The generated directory is packaged, uploaded, backed up, or shared.
6. A recipient or any party with access to the output obtains the extracted memory content.

Impact Assessment

The funct ...[truncated 680 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not copy raw MEMORY.md content by default.
2. Require an explicit option such as --include-memory-content before extracting memory text.
3. Prefer a schema-based parser that extracts only approved fields instead of arbitrary text.
4. Scan candidate content for credentials, tokens, private keys, email addresses, personal identifiers, and financial data.
5. Stop generation when high-confidence secrets are found; do not rely solely on automatic masking.
6. Show the user an extraction preview and require confirmation before writing sensitive content.
7. Record only a generic source identifier rather than an absolute or environment-revealing path.
8. Create output files with restrictive permissions where supported.
9. Add tests covering secrets at the beginning and end of short memory files.

T09 · Insecure Skill Coding Practices

Warning

• Location: MIGRATION-GUIDE.md:469

Finding

Documentation encourages submission of sensitive JSON to third-party validators

Content

View full analysis

Vulnerability Details

File Location: MIGRATION-GUIDE.md:469-486
Vulnerability Type: Unsafe external disclosure workflow
Risk Level: Medium

Vulnerable Documentation

The relevant source section recommends these external services:

markdown

| Tool | URL |
|------|-----|
| JSONLint | https://jsonlint.com |
| JSON Editor Online | https://jsoneditoronline.org |
| JSON Formatter | https://jsonformatter.curiousconcept.com |
| BeautifyTools | https://beautifytools.com/json-validator.php |

It then instructs the user to perform the following process:

markdown

1. Copy the entire contents of the JSON file.
2. Paste the contents into the JSONLint text box.
3. Select the validation action.

This is an English rendering of the relevant source instructions. The URLs and workflow are unchanged.

Technical Analysis

The same project classifies owner.json as private and classifies memory.json and relations.json as sensitive. Those files are designed to contain personal details, schedules, business information, contacts, relationship records, and communication summaries.

Instructing users to copy an entire JSON file into an external website causes data to cross the local trust boundary. The guide provides no restriction limiting these services to public, synthetic, or fully redacted files. It also does not describe the external services' retention, logging, telemetry, jurisdiction, or privacy behavior.

A safe local validator already exists in scripts/migrate.py, making disclosure to external services unnecessary.

Attack Path

1. A user populates an owner, memory, or relationship template with actual data.
2. The user follows the validation section in the migration guide.
3. The user copies the entire private or sensitive JSON document.
4. The document is pasted or uploaded to a third-party validation service.
5. The third party receives the complete document and may ...[truncated 820 chars]

Remediation

View remediation

Remediation Suggestions

1. Make python scripts/migrate.py validate the primary validation method.
2. Explicitly prohibit uploading private or sensitive migration files to online validators.
3. If external tools remain documented, limit their use to synthetic, public, or fully redacted examples.
4. Add a warning immediately above every external validation workflow.
5. Explain that third-party services may log, retain, or process submitted content.
6. Provide equivalent offline instructions using Python's standard JSON parser or a trusted local editor.
7. Add sensitivity-aware validation guidance for every migration file type.
8. Require consent before any document containing third-party information is submitted externally.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (38)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The metadata asserts that private information such as email has been desensitized or locked, yet the body includes cleartext email addresses and notes indicating they are 'unlocked'. This contradiction is dangerous because downstream users may rely on the privacy note and redistribute the file, unintentionally exposing contactable identities and enabling phishing, impersonation, or unwanted outreach.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file explicitly prescribes a single locale-specific timestamp format, "北京时间" (+08:00), as the unified standard. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy concern unless the constraint is clearly justified as region-specific, which is not stated here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly states that the example package contains real personal and sensitive information and says it is 'for reference learning only,' but it does not strongly prohibit reuse, sharing, publication, or redistribution. In a migration-pack skill designed to transfer identity, memory, and relationship data, normalizing real sample data increases the risk of accidental disclosure, copying into downstream environments, or inclusion in public repositories.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file encodes the owner's profile, schedule, and interaction preferences entirely in Chinese, including the preferred communication style at L20. For a generally applicable skill/profile file, this implies a fixed language/locale without any documented user choice or opt-in, which matches the policy category for language or locale constraints.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This example file claims to be a desensitized relationship record, but it still contains personally identifying and relationship-linked data such as usernames, profile URL, nicknames, trust levels, work background, communication history, and at least some direct contact details. In a migration/share pack context, this materially increases the risk of privacy leakage, social graph disclosure, profiling, and targeted social engineering against both the primary agent owner and listed contacts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The human-readable description and most natural-language content in this JSON are entirely in Chinese, with no indication that users can choose another language or that the file is intentionally limited to a Chinese-language context. Under the stated policy, fixed language behavior without opt-in or documented justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This file contains sensitive social graph data, contact details, trust levels, collaboration history, and notes about communication readiness, but it does not define any access conditions, purpose limitation, or activation scope. In an agent migration pack, that makes over-collection and unintended disclosure more likely because the dataset can be loaded or transferred broadly to new environments or users without clear authorization boundaries.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Line L06 specifies the conversation tone entirely in Chinese and implies a fixed Chinese/WeChat chat style. This is a natural-language locale constraint, and the file does not indicate any user choice, opt-in, or region-specific justification for enforcing that language/style.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This markdown file forces a specific language/locale in its user-facing instructions, which can violate language-choice policy when no opt-in or alternative is provided. The document does not indicate that the skill is region-specific or that Chinese is optional.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

文件标题与全文说明均以中文编写，并将该模板作为“标准化工具包”面向广泛用户使用，但没有说明这是仅限中文用户的区域性文档，也没有提供语言选择或用户 opt-in。根据语言/locale 政策，这构成了默认强制特定语言的自然语言约束。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises scripts that generate, validate, and package migration data, implying file read/write behavior, but it does not declare any explicit tool scope or permissions boundaries. For a migration pack that handles identity, memory, relationships, and owner data, undeclared filesystem capability increases the risk of overbroad access, accidental collection of unrelated files, or unsafe writes during packaging.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This skill is specifically designed to export and share highly sensitive agent state, including identity, memory, session state, relations, skills, style, and owner boundary data, yet the description does not warn users that the package may contain sensitive or personal information. In this context, omission of a clear warning materially increases the chance of unintended disclosure, unsafe sharing, and privacy or security harm during migration or publication.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The natural-language descriptions, examples, and instructions in this identity template are entirely written in Chinese, including user-facing fields such as the agent description and completion instructions. Because the template does not offer any language choice or explain a region-specific requirement, it appears to impose a specific language/locale by default.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The template explicitly names multiple upstream sources such as conversation history, Feishu/email, and AgentLink as inputs for memory population, but it does not define scope limits, consent requirements, or filtering rules. In a migration pack marked as 'sensitive', this can cause an agent or operator to ingest excessive personal, business, or third-party data into long-term memory, creating privacy leakage and over-collection risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This JSON template presents all human-readable descriptions, notes, and examples in Chinese, which imposes a specific language on skill authors or users. The file does not offer an alternative language, opt-in mechanism, or justification that the template is intended only for a Chinese-speaking or region-specific environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The template’s natural-language descriptions and instructions are written entirely in Chinese, including required usage guidance such as the instruction to delete value/example/description scaffolding before filling actual values. There is no indication that users may choose another language or that the Chinese-only constraint is documented as an intentional region-specific requirement.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This template goes beyond a neutral migration record by explicitly modeling investment strategies, arbitrage-related collaboration, social learning topics, and relationship expansion planning. In a migration pack, bundling behavioral playbooks and sensitive strategy context increases the chance of over-collection, inappropriate transfer, and reuse of high-risk personal or financial profiling data in a new environment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The template includes candidate tracking, interest rationale, outreach strategy, target counts, and priority profiles, which effectively operationalize prospecting and social expansion rather than migration. That broadens the skill from state portability into growth/targeting functionality, enabling profiling of third parties and transfer of outreach intelligence without clear necessity or consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This JSON template embeds all user-facing descriptions and examples in Chinese, including the primary description, field descriptions, and example task content. Because the file provides no indication that Chinese is optional or that the template is intended only for a Chinese-language or region-specific context, it creates a language-policy concern under the locale-choice rule.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · TEMPLATE/session-state.template.json (reported line 63)May include surrounding context.

json

"schedule": "09:00-11:00, 17:00",
        "next_run": "2026-04-14T09:00:00+08:00",
        "last_result": "success",
        "auto_execute": true
      }
    ],
    "value": []

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest/template content is entirely written in Chinese, including the primary description, field descriptions, and usage instructions, with no indication that language selection is optional or that the template is specifically intended only for a Chinese-language environment. This creates a natural-language locale constraint that may violate language-choice policy for general-use skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown template is entirely written in Chinese and frames the expected interaction style, examples, and field values only in Chinese. That creates a language/locale constraint without any visible indication that users may choose another language or opt in to Chinese, which matches the policy's language-choice concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's user-facing documentation, help text, comments, and generated README content are entirely in Chinese, indicating a fixed language/locale experience. There is no indication that users may opt into another language or that the tool is intentionally restricted to a Chinese-only audience for a documented reason.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script reads from USER.md and MEMORY.md and copies their contents or references into a new export package without an explicit consent prompt, sensitivity warning, or redaction step. Because this tool is specifically designed for migration/sharing, the copied data may include personal, private, or operationally sensitive information that gets redistributed more broadly than intended.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script exposes a behavioral mismatch between the CLI contract and implementation: --include-skills is presented as optional and 'not included by default', but generate_pack() always extracts and writes SKILLS/catalog.json. In a migration/export tool, this can cause unintentional disclosure of installed skills inventory and paths when a user believes they are excluded.

Content

No source excerpt is available for this finding.