Smart Memory

• Outcome: Review
• Latest audit: Jul 9, 2026 · 5:24 PM UTC
• Version: 2.2.7

Overview

This is mostly a local long-term memory tool, but it should be reviewed because it can persist conversation-derived data and environment details while some automatic maintenance and mutation behavior is under-scoped.

Install only if you want an agent to keep local long-term memory. Review the stored database and avoid enabling scheduled or auto-confirm maintenance until privacy, retention, backup, and confirmation behavior are clear. Treat env-snapshot as optional diagnostic data, and pin dependencies if reproducible installs matter.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (22)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises executable capabilities including shell access, filesystem reads/writes, and environment access, but the metadata shown here does not declare permissions or warn users about that operational scope. In a memory-management skill, these capabilities materially expand what the skill can touch, increasing the risk of unintended data access, persistence changes, or host information exposure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The documented purpose frames the skill as a long-term memory system, but the described behaviors extend into environment fingerprinting, migration/rollback, validation, checksum/manifest rebuilding, and bulk prechecks of files and environment variables. That mismatch can mislead users and reviewers about the skill's real access and side effects, making sensitive host inspection and state-changing maintenance actions more likely to be invoked without informed consent.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The README claims the skill is fully offline and zero-dependency, yet also documents an AI-driven nightly maintenance workflow that performs diagnosis, anomaly handling, and repair-oriented actions. Even if the code path is external to this repository, this is a security-relevant documentation mismatch because operators may grant broader trust or automation privileges to a memory skill than they would to a self-modifying maintenance workflow.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: A long-term memory skill is documented as supporting autonomous diagnosis and code-repair behavior, which exceeds the principle of least privilege for its stated purpose. If an agent follows these instructions, the skill can become a stepping stone for unattended repository changes or broader system actions unrelated to memory management.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: This code collects OS, Python, shell, and Git details and stores them in `env_snapshots`, creating a persistent host fingerprint unrelated to the core recall/record functions of a memory skill. In an agent setting, this increases privacy risk and can leak sensitive environment details that help an attacker profile the host, tools, and likely execution context for later attacks.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The recall path performs an unexpected state-changing write by automatically updating manifest checksums during what should be a read-oriented retrieval operation. This can silently bless modified files as trusted, weakening integrity guarantees and creating a confused-deputy style risk if an attacker can alter referenced documents before recall occurs.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The recall path performs an unexpected state-changing integrity write by updating manifest checksums during what should be a read-oriented operation. This can normalize tampered or drifted files by replacing the stored expected checksum with the current on-disk value, weakening integrity guarantees and making unauthorized modifications harder to detect later.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README emphasizes persistent storage of recalled knowledge, harvested conversation content, and session snapshots, but does not clearly warn users about retention, sensitivity, or privacy implications. In agent environments, this can lead to unintentional long-term storage of secrets, personal data, or proprietary conversation content.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger list includes very common terms such as '记忆', 'memory', '记录', and 'recall', which are likely to appear in ordinary conversation unrelated to this skill. Overbroad activation increases the chance the skill runs unintentionally, which is especially risky here because the skill can read/write persisted data and perform maintenance actions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The command list includes mutating and potentially destructive operations such as record, signal, migrate, restore, slim, and gc, including a non-dry-run garbage collection command, but the description does not warn users about persistence changes or deletion risk. In a long-term memory system, silent or poorly signposted data mutation can cause accidental loss, corruption, or retention of sensitive information.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The maintenance script performs state-changing operations automatically using flags like --auto-write with only generic progress output, which can modify long-term memory data without a clear interactive warning or approval step. In a memory-management skill, this increases the risk of unintended data corruption, persistence of hallucinated content, or irreversible bulk changes when the script is run from cron or by an unsuspecting operator.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The `env-snapshot` command persists environment fingerprint data with only basic status output and no meaningful consent flow, privacy notice, or data minimization. Users may invoke it without understanding that system details will be stored, creating avoidable privacy and telemetry risks.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The rollback() method performs unconditional DELETE operations across multiple tables and commits immediately, with no confirmation gate, scoping, or backup/transaction safety beyond the single commit. In a migration utility, this creates a real risk of accidental destructive data loss if the function is invoked against the wrong database or by automation, especially because the default DB path may be resolved implicitly from the v3 module.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: migrate_docs() deletes the entire existing target directory with shutil.rmtree() before copying new content, without validating that the target path is expected or prompting for confirmation. If target_dir is misconfigured or attacker-influenced by a caller, this can erase unrelated files and cause irreversible data loss beyond the migration scope.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Automatic manifest updates cause file-affecting persistent writes without any user-facing warning, confirmation, or transparency. In a memory recall skill, hidden writes are especially risky because users and calling agents are likely to assume retrieval is side-effect free, allowing trust metadata to be altered unexpectedly.

Missing User Warnings

Medium

• Confidence: 77% confidence
• Finding: The migration deletes an existing target docs directory with shutil.rmtree() before copying replacement content, without any confirmation, backup, or path safety checks. If target_dir is wrong, attacker-influenced, or points to a valuable directory, the operation can irreversibly erase unrelated files.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: Rollback issues unconditional DELETE statements across multiple tables and commits immediately, with no in-function confirmation, dry-run safeguard, or backup step. If triggered accidentally or through an exposed interface, it can permanently destroy memory data and associated migration state.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| `build-index` | 全量重建 TF-IDF 索引 |
| `migrate` | 从 self-learning-skills 迁移历史数据 |
| `signal --kind card_recalled --card-id xxx --context "上下文"` | 记录记忆使用信号 |
| `harvest --text "对话摘要" --auto-confirm` | 对话启发式收割 |
| `session --summary "任务摘要"` | 创建会话快照 |
| `session-list --days 7` | 列出历史会话快照 |
| `dedup --threshold 0.45` | 语义去重检测 |

• Confidence: 78% confidence
• Finding: The `harvest --auto-confirm` option enables automatic acceptance of heuristically extracted knowledge from conversation summaries without an explicit review step. In context, this can persist inaccurate, sensitive, or adversarially injected content into long-term memory, making future agent behavior easier to poison or skew.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# 1. 对话收割：从最近对话提取知识卡片
echo "[1/6] 对话收割..."
if [ "$DRY_RUN" = true ]; then
    python "$MEMORY_PY" harvest --days 1 --auto-confirm --dry-run
else
    python "$MEMORY_PY" harvest --days 1 --auto-confirm
fi

• Confidence: 88% confidence
• Finding: The use of --auto-confirm causes autonomous extraction of knowledge cards from recent conversations without an approval checkpoint. In this skill context, that is risky because the system handles long-term memory and may ingest sensitive, low-quality, or unintended content into persistent storage automatically.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

if [ "$DRY_RUN" = true ]; then
    python "$MEMORY_PY" harvest --days 1 --auto-confirm --dry-run
else
    python "$MEMORY_PY" harvest --days 1 --auto-confirm
fi

# 2. 语义去重：检测高度相似的记忆对

• Confidence: 88% confidence
• Finding: This invocation again enables autonomous confirmation for harvesting, this time in the non-dry-run path where changes are actually committed. Because the script is intended for scheduled unattended execution, the absence of human review makes accidental retention of sensitive or incorrect memory more likely.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

jieba>=0.42.1
pyyaml>=6.0

• Confidence: 95% confidence
• Finding: The dependency specification uses a lower-bound only constraint (jieba>=0.42.1), which allows installation of any future version without review. This creates supply-chain risk because incompatible or compromised upstream releases could be pulled into the environment, reducing build reproducibility and potentially introducing vulnerable code unexpectedly.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

jieba>=0.42.1
pyyaml>=6.0

• Confidence: 98% confidence
• Finding: The requirement pyyaml>=6.0 is unpinned, so any later release may be installed automatically. Because PyYAML is a widely used parsing library that often processes untrusted data in automation contexts, leaving it floating increases supply-chain and reproducibility risk if a future release introduces a vulnerability, malicious package compromise, or breaking behavior.

Static analysis

No suspicious patterns detected.