personal-memory-system

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:00 AM UTC
• Version: 3.1.0

Overview

This is a coherent local journaling memory skill, but it persistently stores and reuses very sensitive personal history with broad activation language and an unpinned installer command.

Install only if you intentionally want an AI assistant to keep a long-term local journal and personal profile. Keep /memory/ private, encrypted if possible, avoid broad/global auto-trigger rules, and prefer a pinned or reviewed installer instead of copying unpinned npx commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: AGENTS.md:14

Finding

Unpinned Third-Party Package Execution During Installation

Content

View full analysis

Vulnerability Details

File Location: AGENTS.md:14
Additional Locations: README.md:53, README.md:56, README.md:59, README_EN.md:92
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash

# AGENTS.md:13-14
# Recommended method (through the Skills CLI)
npx skills add ChenChen913/memory-system -a claude-code

Equivalent unpinned installation commands also appear in the project documentation:

bash

npx skills add ChenChen913/memory-system
npx skills add ChenChen913/memory-system -a claude-code
npx skills add ChenChen913/memory-system -g

Technical Analysis

The installation instructions invoke the third-party skills package through npx without specifying a reviewed version or verifying package integrity. If the package is not already installed locally, npx can retrieve its current release from the configured npm registry and execute it immediately.

Consequently, the effective installer is mutable and lies outside this audited repository. The project does not provide a version constraint, lockfile, checksum, signature, or reviewed installer artifact that would ensure users execute the same dependency that was assessed by the project author.

This is a supply-chain exposure rather than evidence that the current skills package is malicious. Exploitation would require compromise, replacement, or malicious publication of the package or its dependency chain.

Attack Path

1. An attacker compromises the npm account, registry distribution path, package contents, or a transitive dependency used by the unpinned skills package.
2. The attacker publishes a malicious release under the package version selected by npx.
3. A user follows the documented installation command.
4. npx resolves and downloads the attacker-controlled release.
5. The package executes with the privileges of the user running the command.
6. Malicious installer code can access files and credentials availab ...[truncated 825 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to an explicitly reviewed version:

bash

npx --yes skills@<reviewed-version> add ChenChen913/memory-system -a claude-code

2. Record the approved package version in every installation example so users do not fall back to the latest mutable release.

3. Publish and document cryptographic checksums or signatures for release artifacts, and instruct users to verify them before installation.

4. Prefer a verified release archive or an installer committed to this repository over immediate execution of remotely resolved package code.

5. Review and lock transitive dependencies used by the installation tooling. Enable automated alerts for package ownership changes and dependency compromises.

6. Document the expected package publisher, registry, version, and integrity value so users can detect substitution or registry misconfiguration.

7. Advise users not to run the installer with administrator privileges and to perform installation in a restricted environment where practical.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (56)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The Cursor rule includes catch-all wording like related instructions and tells the agent to read and execute the skill guidance when users say common phrases. This ambiguity can cause over-triggering in normal conversation, leading the agent to load memory behavior unexpectedly and potentially process or persist sensitive user data without clear consent.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · AGENTS.md (reported line 66)May include surrounding context.

cp -r memory-system/ ~/.gemini/instructions/memory-system/

text

在 `~/.gemini/config.yaml` 中添加：
```yaml
instructions:
  - path: ~/.gemini/instructions/memory-system/SKILL.md

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill declares a very broad trigger list including common phrases like '记录今天', '帮我做决策', '预测一下', and '我很崩溃', which could cause the memory system to activate during ordinary conversation. In a skill that reads and writes long-lived personal memory files, unintended invocation materially increases the chance of unnecessary access to sensitive data and accidental persistence of user disclosures.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 76% confidence

Finding

The installation command uses npx skills without pinning a specific package version or commit, so the executed code can change over time based on the registry state. This creates a supply-chain risk: a compromised or malicious future package release could run arbitrary code during installation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger examples are broad conversational phrases such as decision help and summaries, which can cause the skill to activate during ordinary user requests that are not intended to access or update private memory data. In a personal memory skill, accidental invocation is risky because it may expose sensitive historical data or write unintended records.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The file embeds a fixed Chinese system prompt for Trae, presenting a single-language operating mode without indicating user opt-in or language alternatives. This can violate language/locale policy expectations when the tool or user context may be multilingual.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to run npx skills add ... without pinning an exact package version. npx resolves and executes the latest published package, so a compromised or malicious upstream release of skills could execute arbitrary code during installation. In a skill-distribution context, install commands are a trusted path and therefore especially sensitive.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This installation example also invokes npx skills without an exact version pin. That creates a supply-chain risk because the fetched executable may change over time or be replaced by a compromised release, leading to arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The global install example relies on unpinned npx skills, which exposes users to the same upstream package substitution or malicious update risk. Because installation commands are often copied verbatim from documentation, this is a practical supply-chain weakness rather than a theoretical one.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The README again recommends npx skills add ... as the canonical installation path without version pinning. Repetition increases exposure because users are encouraged multiple times to execute a mutable remote package by name.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is designed to trigger on many broad, everyday phrases such as journaling, reflection, decision-making, and emotional statements. In an agent environment, overly broad activation criteria can cause unintended invocation, leading the skill to collect, infer, or persist highly sensitive personal data when the user did not explicitly mean to engage the memory system.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The Claude Code install command uses npx skills without pinning, preserving the same supply-chain execution risk. In documentation for an AI skill, installer integrity is important because users may grant broad local access to tooling during setup.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This OpenClaw installation example references an unpinned npx skills package, allowing the executed installer to vary over time. If the package or one of its dependencies is compromised, users may run attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The Cursor installation command similarly uses unpinned npx skills, creating a reproducibility and supply-chain trust problem. Because this is presented as normal setup guidance, a compromise would likely affect users at scale.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The invocation phrases are broad enough to match normal conversation, which can cause the skill to activate when the user did not intend to use a persistent memory system. In this skill's context, accidental activation is more sensitive because it handles intimate journaling, profiling, and long-term personal data retention.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description says the skill should 'immediately trigger' on listed phrases, while metadata sets autonomous_invocation: false and the safety section says it should only run on explicit user request. That mismatch creates ambiguity about whether casual mention of a phrase counts as consent, which can lead to unauthorized memory access or writes despite the stated non-autonomous design.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · AGENTS.md (reported line 174)May include surrounding context.

Windows：使用 BitLocker 或 VeraCrypt

建议限制文件系统访问权限：

chmod 700 ~/memory/

text

### 敏感内容处理

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 109)May include surrounding context.

Windows：使用 BitLocker 或 VeraCrypt

建议限制文件系统访问权限：

chmod 700 ~/memory/

text

### 敏感内容处理

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README_EN.md (reported line 152)May include surrounding context.

Windows：使用 BitLocker 或 VeraCrypt

建议限制文件系统访问权限：

chmod 700 ~/memory/

text

### 敏感内容处理

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

Windows：使用 BitLocker 或 VeraCrypt

建议限制文件系统访问权限：

chmod 700 ~/memory/

text

### 敏感内容处理

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

These instructions require loading profile data on every use and, for several modes, reading recent diaries, signals, pattern logs, and other historical files by default. That creates broad retention and reuse of personal information across future interactions, which violates data minimization and increases privacy harm if the skill is invoked unnecessarily or the stored files are later exposed.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The persona language says the AI '记得你说过的一切' and frames itself as uniquely understanding the user over time. In a memory skill, this encourages exhaustive retention of disclosures and normalizes persistent profiling, which can lead to over-collection and inappropriate reuse of sensitive personal data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

All user-facing instructions and example prompts in the file are in Chinese, and the skill does not indicate that language selection is optional or configurable. Under the stated policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless the restriction is clearly justified.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill establishes a mechanism to collect, classify, and persist a user's historical writings and life records across multiple memory categories, enabling broad accumulation of sensitive personal data. In context, this is more dangerous because the system also builds profiles, AI portraits, goals, and behavioral patterns, which amplifies privacy risk through aggregation, inference, and long-term retention.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.