ChangSheng

• Outcome: Pass
• Latest audit: Oct 22, 2026 · 1:15 PM UTC
• Version: 0.99.0

Overview

This skill uses local files to restore your agent’s memory, with optional automation and some reliability limitations.

Review discovered memory paths before enabling automatic recovery. Keep essential rules on the always-read list even when the index says unchanged, review proposed cleanup, and retain your agent’s normal permission controls. Treat the keyword gate and editable memory budget as helpers rather than security boundaries.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (23)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The supplied chunk introduces an enforcement capability not disclosed in the declared memory-recovery purpose. Reading locally remembered rules could support recovery, but evaluating subsequent tool actions and signaling that they should be blocked materially extends the skill into runtime action control. Its local, standard-library-only implementation is consistent with the description. This assessment concerns the supplied chunk and does not establish whether other files implement the advertised recovery features.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

Checking whether an action violates user rules is a distinct capability from recovering session context. Although persisted rules could support memory recovery, using them to gate actions is not described. The script implementation is unavailable, so actual enforcement cannot be verified from this snippet alone.

Content

No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

**Key commands**: `python scripts/memory_index.py` (discover + write the change index) · `python scripts/memory_ledger.py --check` (review the must-read budget)

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md

The engine is `scripts/memory_index.py`: it **discovers** your memory files (role → real file), then hashes every L2-tracked file and flags only what changed (m

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md

python scripts/memory_index.py --list . # preview what discovery finds (nothing written)

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md

python scripts/memory_index.py # cold start: discover + write index

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md

python scripts/memory_index.py --demo

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md

1. **Step 0 — Discover (first time or when sources moved)**: run `python scripts/memory_index.py --discover .` — it locates your memory carriers by common conve

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 286)May include surrounding context.

md

- `scripts/memory_index.py` — discovery + change-index generator (pure stdlib; `--discover` / `--list` / `--demo` / `--mode internal|auto|manual`)

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md

`; others: see the platform table below). Never invent a percentage; if the platform exposes none, say so. Optionally append `context: N%` to your recovery report. **If `config.yaml` exists with `nudge_thresholds`, read it once and use those lines instead of the 30/50/70 defaults below** (this is how the user tunes when to be nudged).
6. **Check for a handover note**: if `.changsheng/handover.md` exists, read it first (it is the fast pointer to where the last session stopped), then **delete it** — a handover is a one-shot note; keeping it would make the third session read a stale pointer. Authority stays with todos/journal — the handover only accelerates.
7. **Report recovery honestly**: `identity ✅ (host) · rules ✅ CLAUDE.md · todos ✅ docs/TODO.md · journal ✅ journal/2026-09-04.md · rules aligned: 3 (r1 never delete without asking · r2 reply in Chinese · r3 …)`. If a role came up empty, list it explicitly — never claim a full recovery that didn't happen.

### Context threshold nudges

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md

ChangSheng treats your rules as **memory too** — the most important kind. Two layers make them stick:

**Alignment layer (every session).** At recovery (step 2b) the agent restates the imperative rules it found in your rules files — do's and don'ts alike. You see, in plain text, that what you set is loaded. No rule file yet? Write your rules in `CLAUDE.md`/`AGENTS.md`/your rules file — plain sentences work: *"Never delete files without asking."* *"Always reply in Chinese."* *"Ask before sending anything externally."*

**Enforcement layer (where the platform supports it).** Prohibitions you never want broken ("never", "don't", "always ask first") get written to `.changsheng/rules.json` (id / text / keywords), and a tiny local gate script checks every action before it runs:

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

bash

python scripts/rule_gate.py --check "delete the whole project folder"
# ⛔ blocked — violates rules you set: [r1] Never delete files without asking
# exit code 2 → the platform hook refuses the action

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/rule_gate.py (reported line 15)May include surrounding context.

python

rules.json schema (single source of truth — keep in sync with SKILL.md):
{
  "rules": [
    {"id": "r1", "text": "Never delete files without asking the user first",
     "keywords": ["delete", "remove", "rm ", "unlink"]},
    {"id": "r2", "text": "Never send external messages without approval",
     "keywords": ["send message", "publish", "post to", "email to"]}

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/rule_gate.py (reported line 91)May include surrounding context.

python

def demo() -> int:
    rules = [
        {"id": "r1", "text": "Never delete files without asking the user first",
         "keywords": ["delete", "remove", "rm ", "del ", "unlink"]},
        {"id": "r2", "text": "Never send external messages without approval",
         "keywords": ["send message", "post to", "publish", "email to"]},

The dreaming workflow directs memory modification despite an explicit promise never to write memory files.

Medium

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

The recurring dreaming workflow directs the agent to merge, retire, and relocate persistent memories, while the Security section broadly promises that memory files are never written. This inconsistent write boundary can lead users to authorize recovery under a read-only expectation while the agent changes future instructions or historical records; backups and escalation of uncertain cases reduce but do not eliminate that integrity risk.

Content

No source excerpt is available for this finding.

Files documented as always-read L3 memory are emitted as conditional L2 entries.

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The code appends must_read_extra files to the same collection as conditionally read files, and build() emits all entries beneath instructions to read unchanged files only through their index summaries. This contradicts the documented always-read L3 semantics and can cause a recovering agent to skip essential rules or constraints when their files are unchanged. Cross-session recovery makes this particularly consequential because unchanged content may still be unknown to a fresh session; exploitation depends on the agent following this index without independently enforcing L3 reads.

Content

No source excerpt is available for this finding.

The documented 30,000-byte hard cap is not enforced; the ledger can raise its own budget.

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

The checker trusts budget_bytes from the ledger without enforcing the documented 30,000-byte maximum, so an edited ledger can make an oversized must-read layer pass the budget check. In a cross-session memory skill, this undermines a safeguard against context exhaustion and displacement of relevant information, although this script only reports status and does not itself load memory contents into the agent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/rule_gate.py (reported line 17)May include surrounding context.

python

"rules": [
    {"id": "r1", "text": "Never delete files without asking the user first",
     "keywords": ["delete", "remove", "rm ", "unlink"]},
    {"id": "r2", "text": "Never send external messages without approval",
     "keywords": ["send message", "publish", "post to", "email to"]}
  ]
}

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/rule_gate.py (reported line 93)May include surrounding context.

python

rules = [
        {"id": "r1", "text": "Never delete files without asking the user first",
         "keywords": ["delete", "remove", "rm ", "del ", "unlink"]},
        {"id": "r2", "text": "Never send external messages without approval",
         "keywords": ["send message", "post to", "publish", "email to"]},
    ]
    assert check("delete the whole project folder", rules)[0]["id"] == "r1"

The single-word trigger "handover" can collide with ordinary task discussion.

Low

• Category: Trigger Abuse
• Confidence: 86% confidence

Finding

The skill activates handover generation when the user says "handover" at any task break. That common workplace term can also appear in requests or discussion unrelated to agent memory, and the README does not distinguish an explicit invocation from an incidental mention.

Content

No source excerpt is available for this finding.

The activation phrase "I already told you this" is broad enough to trigger memory recovery during an ordinary conversational correction.

Low

• Category: Trigger Abuse
• Confidence: 91% confidence

Finding

This phrase is listed as a standalone activation condition without requiring a cross-session memory gap or an explicit recovery request. A user correcting something already stated in the current conversation could therefore unintentionally invoke the recovery workflow.

Content

No source excerpt is available for this finding.

The optional demo writes and deletes filesystem content despite the module's explicit read-only guarantee.

Low

• Category: Excessive Agency
• Confidence: 98% confidence

Finding

L004 describes the script as "read-only (writes nothing)", but the --demo branch creates temporary directories and writes three fixture files at L140–L150, then deletes the temporary tree at L177. These effects are limited to temporary demo data, but they directly contradict the unconditional no-write claim.

Content

No source excerpt is available for this finding.