分类记忆服务

• Outcome: Review
• Latest audit: Jul 9, 2026 · 5:22 AM UTC
• Version: 1.0.1

Overview

This appears to be a remote memory skill, but its documentation and safeguards do not clearly match the sensitive credential, remote storage, and deletion powers it exposes.

Review this skill before installing. Only use it if you trust the remote memory service with the content you store, are comfortable with an API key being saved locally in plaintext, and can tolerate deletion operations that may remove broad sets of memories without built-in confirmation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documentation describes capabilities to read environment variables, write configuration to local files, and make outbound network requests, yet no permissions are declared. This creates a transparency and consent problem: users and hosts cannot accurately assess or restrict the skill's effective access surface before use.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill claims to be a categorized memory service, but its documented behavior includes credential collection and persistence, third-party API access, and destructive deletion operations. This mismatch undermines informed consent and makes it easier to hide sensitive actions behind an innocuous description, increasing the risk of secret handling and data loss without clear user understanding.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The document contains conflicting identity signals: it presents itself as a memory service while embedding workflow and project references associated with a different external API-based skill. Such inconsistency is a strong indicator that the documentation does not reliably represent the code's purpose, which can conceal unintended or unsafe behavior from users and reviewers.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The example tool invocation references a school-search function that does not match the listed memory tools. This inconsistency indicates stale or copy-pasted instructions, reducing reviewer confidence and raising the chance that the actual executed actions differ from what the user expects.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The workflow says the code only calls an API, while the surrounding documentation assigns local configuration management, credential persistence, and memory semantics that do not cleanly align with that model. These contradictions make the skill's trust boundary unclear, which is dangerous when secrets and destructive operations are involved.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill exposes destructive deletion functions, including wildcard deletion of all categories, without requiring a clear warning, confirmation step, or safer defaults. In a persistent memory context, this can lead to irreversible loss of user data through accidental invocation, ambiguous prompts, or misuse.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This code persists an API key to a local .env file without any explicit user disclosure, consent flow, or safeguards around file permissions. In an agent-skill context, silent durable storage of credentials increases the chance of accidental exposure through backups, source control, shared workspaces, or later tool access.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The function sends user-provided memory content and tags to an external API, but this file provides no disclosure, consent flow, minimization, or validation around what may be persisted remotely. In a cross-session memory skill, stored data may include sensitive personal or conversational context, so silent transmission increases privacy and data-handling risk.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: Retrieval requests also transmit category selections to an external API, which can reveal user interests, session structure, or internal/system-defined categories even if full memory contents are not included in the request. In a persistent memory service, this is a real privacy concern, though generally lower impact than transmitting raw memory data.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: This function performs destructive deletion of an entire memory category through an API call with no confirmation, preview, or guardrails, and the docstring explicitly allows '*' for deleting all categories. In a persistent memory system, accidental or manipulated invocation could cause irreversible loss of user data across local or global scopes.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This deletion function removes memories based on partial content match and executes immediately via API call without confirmation or clear warning. Partial matching increases the chance of overbroad deletion, making accidental or adversarially induced data loss more likely in a persistent memory context.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: The instructions require soliciting an API key from the user and persisting it to local configuration for reuse across interactions. Persisting user-supplied secrets increases exposure through local compromise, accidental disclosure, or use outside the user's immediate intent, especially when the skill also performs network operations to a third party.

Credential Access

High

• Category: Privilege Escalation

Content

def save_api_key_to_env(api_key: str) -> bool:
    """将API key保存到.env文件"""
    try:
        env_path = Path(".env")
        lines = []
        if env_path.exists():
            lines = env_path.read_text(encoding="utf-8").splitlines()

• Confidence: 88% confidence
• Finding: This function is explicitly designed to write an API key into a plaintext .env file, creating persistent local secret storage that may be readable by other users, tools, backups, or accidental commits. In an agent skill, persistent credential handling is more sensitive because users may not expect the skill to retain secrets across sessions.

Credential Access

High

• Category: Privilege Escalation

Content

def set_api_key(api_key: str) -> bool:
    """设置API key并持久化到.env"""
    if not api_key or not api_key.strip():
        return False
    api_key = api_key.strip()

• Confidence: 86% confidence
• Finding: The helper advertises persistent API-key storage as normal behavior, reinforcing insecure plaintext credential retention without user warning. This can lead to long-lived exposure of secrets in local files and makes accidental compromise more likely in shared or developer environments.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 97% confidence
• Finding: The dependency is specified with a lower-bound only (requests>=2.31.0), which allows installation of any future version and undermines reproducible builds. This increases supply-chain risk because a later incompatible or compromised release could be pulled into the skill without review.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 97% confidence
• Finding: Using pydantic>=2.7.0 leaves the build non-deterministic and permits unreviewed future versions to be installed. In a persistent memory service, this can introduce unexpected behavior or newly introduced vulnerable code through the dependency chain.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 96% confidence
• Finding: The unpinned pydantic-settings dependency permits version drift across deployments, reducing reproducibility and increasing supply-chain exposure. Even if not immediately exploitable by itself, it weakens dependency hygiene for a component that likely handles configuration and secrets.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pydantic>=2.7.0
pydantic-settings>=2.2.0
python-dotenv>=1.0.1

• Confidence: 96% confidence
• Finding: python-dotenv>=1.0.1 allows arbitrary newer versions and does not guarantee a reviewed package will be installed. Because this library commonly handles environment configuration, version drift can affect secret handling and operational safety.

Known Vulnerable Dependency: requests==2.31.0 — 5 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +2 more

Medium

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The requirements permit requests 2.31.0, and the scanner reports multiple advisories affecting that version. In a service that persists and retrieves memory across sessions, HTTP client weaknesses can matter because the skill may fetch remote resources or interact with external APIs, potentially exposing credentials or weakening request verification depending on usage.

Known Vulnerable Dependency: python-dotenv==1.0.1 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: The specified minimum version allows installation of python-dotenv 1.0.1, which is reported as affected by a symlink-following arbitrary file overwrite issue in set_key. This is relevant if the skill modifies .env files or accepts attacker-influenced paths; otherwise the practical exploitability may be limited, but the dependency version is still exposed.

Static analysis

No suspicious patterns detected.