Security audit

Personal Memory System Published

Security checks for vulnerabilities and agentic risk

Overview

The skill is local-only, but it automatically persists personal notes and can replace the memory database without clear safeguards.

Review before installing if your MEMORY.md may contain sensitive information. Use it only if you are comfortable with automatic local duplication into memory.db, make backups before heartbeat sync runs, and avoid letting an agent execute model-generated SQL directly without a constrained read-only query function.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:43
Finding: Unrestricted AI-Generated SQL Queries
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: auto_sync_memory.py:37
Finding: Destructive Full-Table Replacement Can Cause Memory Data Loss
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 描述中最核心的功能不仅包括 MEMORY.md 到 SQLite 的自动同步，还包括自然语言检索和知识库集成；而实际代码只覆盖了其中的同步部分。代码会在 Markdown 更新时间较新时，解析三级标题块并全量重建 memories 表，这与“自动同步到本地数据库”是一致的，也符合“无外部 API 调用”的声明。但描述强调的查询/检索能力是该技能的重要卖点和使用场景，而代码完全未实现，因此存在实质性描述与行为不一致。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README states that the system will automatically sync MEMORY.md into memory.db on every heartbeat, but it does not clearly warn users that potentially sensitive personal notes will be persistently copied to disk in a second datastore. Even though the storage is local-only, silent or poorly disclosed persistence increases privacy risk, broadens the attack surface, and can surprise users who may not expect automated duplication of personal data.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill describes reading sensitive local files such as MEMORY.md and interacting with a local SQLite database, but it does not declare any explicit tool scope or permissions. In an agent framework, undeclared file-read capability weakens least-privilege controls and can cause the runtime or reviewer to underestimate what local data the skill may access.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The inline comment says the old data is cleared 'or optionally: only update changes', implying a synchronization strategy that could preserve existing records or update incrementally. In reality, the code always executes DELETE FROM memories, which wipes the entire table before reinserting current markdown blocks, so the documentation understates the destructive behavior of the sync.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The script deletes all existing rows from the memories table before re-inserting data, which is a destructive operation. Although it prints that synchronization is happening, there is no explicit warning that prior database contents will be wiped and replaced.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Comments and printed status messages are written only in Chinese, which imposes a specific language without any opt-in or explanation of a locale-specific requirement. This can violate language/locale policy when the skill is expected to operate in a general environment.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.