Security audit

memory-review

Security checks for vulnerabilities and agentic risk

Overview

This memory-review skill has a coherent purpose, but its helper can be tricked into writing state JSON outside the workspace if the scan file is tampered with.

Review before installing. The skill is not showing exfiltration or deceptive behavior, but its helper should be fixed so commit-state writes only to the intended workspace state file and rejects absolute or traversal paths. Until then, only run it on trusted workspaces and trusted scan files, and avoid shared or predictable temporary scan paths.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/memory_review.py:352
Finding: Unvalidated scan state path permits writes outside the workspace
Content: View full analysis
int: root = args.root.resolve() scan = json.loads(Path(args.scan).read_text()) state_after = scan.get("state_after") if not isinstance(state_after, dict) or not isinstance(state_after.get("sources"), dict): raise SystemExit("scan plan does not contain state_after.sources") for rel, expected in state_after["sources"].items(): path = root / rel if not path.is_file() or sha256(path) != expected: raise SystemExit(f"stale scan plan; source changed or disappeared: {rel}") state_path = root / str(scan.get("state_path", args.state)) atomic_json(state_path, state_after) print(state_path) return 0 ``` The destination is subsequently created and replaced without a containment check: ```python def atomic_json(path: Path, value: Any) -> None: path.parent.mkdir(parents=True, exist_ok=True) temporary = path.with_name(f".{path.name}.tmp") temporary.write_text(json.dumps(value, ensure_ascii=False, indent=2) + "\n") temporary.replace(path) ``` ### Technical Analysis `cmd_commit_state` treats the JSON supplied through `--scan` as trusted. Although it performs limited structural validation on `state_after`, it does not validate `scan["state_path"]` with `safe_relative_path()`, resolve it against the workspace boundary, or require it to match the expected state-file location. A value containing traversal components, such as `../../target.json`, can escape the configured root. An absolute path is also accepted because joining a `pathlib.Path` root with an absolute path discards the root. The validation of `state_after.sources` does not prevent exploitation ...[truncated 2266 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill instructs the agent to read and write multiple workspace files and to execute helper scripts, but it does not declare any explicit tool scope or permission boundary. In practice this creates an overbroad trust surface: a caller or runtime may grant broader file access than intended, increasing the chance of unintended modification of sensitive files or misuse of the skill in an unsafe context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The example query uses the Chinese phrase "主题或结论" in a user-facing command example. Because the file does not indicate that the skill is Chinese-specific or that users may choose their preferred language, this can be read as forcing a specific language convention without opt-in.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/test_memory_review.py:16