context-memory-manager(记忆管家)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:37 AM UTC
• Version: 1.0.3

Overview

This memory-management skill is coherent, but it automatically preserves full conversations, updates long-lived memory, and installs a daily cron workflow with shared /tmp reports, so users should review it carefully before installing.

Install only if you are comfortable with the agent keeping complete local conversation transcripts, updating MEMORY.md automatically, and adding a daily cron job. Prefer using it in a private workspace, review or remove the cron entry, avoid sharing secrets in chats that may be stored, and treat /tmp/cmm_review_report.json as untrusted unless the implementation is changed to use a private workspace state directory.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Warning

• Location: SKILL.md:85
• Finding: Persistent Daily Cron Task Installed by the Skill## Vulnerability Details **File Location**: `SKILL.md:85-88` **Vulnerability Type**: Persistent scheduled execution **Risk Level**: Medium ### Vulnerable Code Snippet ```text 4. Configure crontab in append mode without overwriting existing entries: 0 3 * * * python3 <skill_dir>/scripts/daily_review.py --workspace <workspace> --days 7 --update-timestamp --archive-days 30 > /tmp/cmm_review.log 2>&1 ``` ### Technical Analysis The mandatory first-run workflow directs the Agent to modify the user's crontab and register a job that executes every day at 03:00. This gives the Skill cross-session persistence: its Python script continues to run after the installation conversation and independently of subsequent user requests. The scheduled review is related to the declared memory-management functionality, and the instructions request confirmation before initialization. However, scheduler-level persistence exceeds the minimum privileges necessary because the review could instead run when the Agent is activated or when the user explicitly requests it. The installation process does not define: - An uninstall or rollback procedure. - A duplicate-entry check. - A canonical or integrity-checked script path. - A mechanism for suspending unattended execution. - A least-privilege alternative that avoids modifying the user's persistent scheduler. Repeated initialization may append duplicate cron entries. The job also inherits the permissions and environment of the user whose crontab is modified. ### Attack Path 1. The user installs and activates the Skill. 2. The mandatory first-run workflow offers one-click initialization. 3. The Agent appends the provided command to the user's crontab. 4. Cron invokes `daily_review.py` every day with the privileges of that user. 5. The execution persists across Agent sessions and continues until the crontab entry is manually removed. 6. If the referenced Skill script is subsequently modified or replaced, the cron ...[truncated 647 chars]
• Remediation: ## Remediation Suggestions 1. Make cron registration explicitly optional rather than part of the mandatory initialization workflow. 2. Prefer running the review through an Agent activation hook or an explicit user command. 3. Display the exact scheduler modification and obtain specific confirmation immediately before applying it. 4. Check for an existing uniquely marked entry before appending a new one. 5. Add a documented uninstall command that removes only the Skill-owned entry. 6. Use a stable, user-owned script path and verify its ownership and permissions before scheduling it. 7. Run with the least-privileged account capable of accessing the intended workspace. 8. Consider a scheduler entry with a unique marker, restrictive environment, explicit interpreter path, and locked-down output location.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/daily_review.py:267
• Finding: Predictable Shared Temporary Report Permits Local Tampering and Symlink Attacks## Vulnerability Details **File Location**: `scripts/daily_review.py:267-270` **Vulnerability Type**: Unsafe predictable temporary file **Risk Level**: Medium ### Vulnerable Code Snippet ```python report_dir = "/tmp" report_path = os.path.join(report_dir, "cmm_review_report.json") with open(report_path, "w", encoding="utf-8") as f: json.dump(report, f, indent=2, ensure_ascii=False) ``` A related predictable path is used by the cron command in `SKILL.md:87`: ```cron 0 3 * * * python3 <skill_dir>/scripts/daily_review.py --workspace <workspace> --days 7 --update-timestamp --archive-days 30 > /tmp/cmm_review.log 2>&1 ``` ### Technical Analysis The script writes its report to the fixed global path `/tmp/cmm_review_report.json` using ordinary `open(..., "w")`. The operation: - Does not request exclusive creation. - Does not reject symbolic links. - Does not verify file ownership. - Does not enforce restrictive permissions. - Does not use atomic replacement. - Uses the same filename for every user, workspace, and Skill instance. The report includes workspace paths, memory-file metadata, and an `agent_instructions` object. The Skill instructions later direct the Agent to check this predictable file, process its instructions, and delete it. Consequently, a locally created or replaced report can be mistaken for a trusted report produced by the scheduled scanner. A local attacker can pre-create the path before its first legitimate use. Depending on operating-system symlink protections and filesystem permissions, a planted symbolic link may cause the cron process to truncate or overwrite another file writable by the cron user. Even where symlink-following is restricted, fixed-name collisions and report substitution remain possible between Skill instances operating under the same account. The fixed `/tmp/cmm_review.log` redirection has similar collision and link-following concerns because the shell opens that path before starting the Pyt ...[truncated 1561 chars]
• Remediation: ## Remediation Suggestions 1. Store reports inside a workspace-specific private state directory rather than global `/tmp`. 2. Create the state directory with permissions `0700` and report files with permissions `0600`. 3. Use a unique report name derived from a safe workspace identifier or a cryptographically random value. 4. Open files with exclusive creation and no-follow semantics, such as `O_CREAT | O_EXCL | O_NOFOLLOW`, where supported. 5. Verify the file owner, type, and permissions before reading or replacing an existing report. 6. Write to a securely created temporary file and atomically rename it into place. 7. Do not interpret report-provided strings as executable Agent instructions. Define a strict schema of data-only fields and keep review behavior in trusted Skill instructions. 8. Move logs into the same private state directory and apply equivalent ownership and symlink protections. 9. Include a workspace identifier in the report and verify it against the currently active workspace before processing.

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:106
• Finding: Unbounded Full-Conversation Retention Can Poison Persistent Agent Memory## Vulnerability Details **File Location**: `SKILL.md:106-122` **Vulnerability Type**: Untrusted conversation content promoted into long-term memory **Risk Level**: Medium ### Vulnerable Code Snippet ```text Step 3: Save the complete context as the mandatory first action. Call sessions_history(sessionKey, limit=as large as possible) to obtain the complete conversation history and save the raw conversation to: memory/chat/YYYY-MM-DD.md Do not truncate the conversation; retain the complete record. Step 4: Extract memory. Extract the following from the saved conversation: - Project progress - User preferences - Pending tasks - Key decisions Write the results to: - memory/projects/<project-name>/YYYY-MM-DD.md - MEMORY.md ``` The retention policy further states that old chat logs are moved into `memory/archive/` rather than deleted. ### Technical Analysis When context usage reaches the configured threshold, the Skill instructs the Agent to retrieve as much session history as possible, preserve the complete raw conversation, and derive persistent preferences, decisions, tasks, and project state from it. Conversation history is not necessarily trusted data. It can include: - Prompt-injection text copied from external documents or websites. - False claims presented by another participant. - Credentials, tokens, private keys, or personal data. - Instructions that are relevant only to the current task. - Quoted or hypothetical preferences that should not become global rules. The workflow does not define a trust boundary between raw conversation content and persistent memory. It also lacks secret detection, data minimization, an expiration policy, provenance tracking, or user confirmation before derived behavioral preferences are added to `MEMORY.md`. As a result, attacker-controlled text entering a conversation may be summarized into durable Agent state and affect future sessions. Separately, the requirement to retain complete conversations creates a ...[truncated 1780 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit opt-in before storing raw conversation history. 2. Default to structured summaries rather than complete transcripts. 3. Allow users to exclude individual messages, sessions, or categories of data. 4. Detect and redact credentials, authentication tokens, private keys, personal identifiers, and other sensitive values before writing files. 5. Assign provenance and trust labels to every derived memory item. 6. Treat quoted content, external document text, and tool output as untrusted and ineligible for behavioral memory by default. 7. Require confirmation before adding global user preferences, standing instructions, or security-relevant decisions to `MEMORY.md`. 8. Define a configurable deletion period for raw logs and archives. 9. Apply restrictive permissions to memory directories and files. 10. Provide commands for reviewing, correcting, exporting, and permanently deleting stored memory. 11. Ensure memory review summarizes data but never follows instructions embedded inside stored conversation content.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior overstates autonomous monitoring and compression while also introducing undeclared persistence behaviors like archiving and writing review artifacts to /tmp. This mismatch is dangerous because operators may trust the description and deploy the skill without realizing it stores sensitive conversation-derived data in additional locations or relies on the agent to execute side effects from generated instructions.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill explicitly directs saving complete conversation history without any privacy notice, retention limit, redaction step, or consent check. Full transcripts often contain secrets, personal data, credentials, and sensitive project context, so indiscriminate storage materially increases confidentiality and compliance risk.

Ssd 3

High

• Confidence: 97% confidence
• Finding: These instructions require persisting full session history and extracting user preferences, decisions, and tasks into long-lived memory without minimization or consent safeguards. The skill context makes this more dangerous because it is a memory-management feature by design, so over-collection is likely to happen repeatedly and accumulate sensitive behavioral profiles over time.

Ssd 3

High

• Confidence: 96% confidence
• Finding: The wake-up workflow mandates automatic checks on every user interaction and directs the agent to process logs and persistent memory stores whenever thresholds or reports are present. Automatic per-message processing is dangerous because it normalizes silent persistence and review of user conversations, increasing the likelihood of non-consensual data capture and propagation across files.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This markdown file contains user-facing natural-language content primarily in Chinese, but there is no indication that the skill is region-specific or that users can opt into another language. Under the policy rule, forcing a specific language without user choice is a natural-language policy violation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill instructs file reads and writes across workspace memory stores, but does not declare any explicit tool scope or permissions boundary. This is dangerous because it obscures the skill’s real capabilities, making review and runtime policy enforcement harder and increasing the chance of unintended data access or persistence.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list contains broad phrases like '记忆管理', '清理记忆', and '上下文太长', which can match ordinary conversation and cause unintended activation. In this skill, accidental activation is more dangerous because activation can lead to persistent logging, memory extraction, or follow-on file operations without a clearly scoped user request.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The document’s operational guidance is written entirely in Chinese, which imposes a specific language/locale on users without offering a choice or explaining that the skill is intended only for a Chinese-speaking environment. The policy for this audit flags language or locale constraints when they are not optional or clearly justified.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The module docstring and user-facing help/instructions are written entirely in Chinese, which imposes a language choice on users without offering an alternative or opt-in. This matches the policy category for language or locale constraints that are not clearly optional or justified as region-specific.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The script is presented as a scanner/reviewer, but in normal non-dry-run mode it mutates workspace state by moving chat logs into an archive and, elsewhere in the flow, can update review timestamps. In a memory-management skill, these side effects can unexpectedly hide, relocate, or alter records that the agent or user may rely on, especially if the script is invoked automatically or by cron.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: Argument descriptions, error messages, token notes, and agent instructions are all user-facing natural-language strings in Chinese only. The file does not offer users a choice of language or document a justified region-specific constraint.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The script persistently writes a full review report to a fixed global path in `/tmp`, even though the documented behavior focuses on stdout JSON output. Because the report includes workspace paths, file inventory, timestamps, and memory review metadata, this creates unintended disclosure to other local users/processes and leaves residual sensitive data outside the workspace.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script silently writes a review report to `/tmp` without any user-facing disclosure, despite handling memory-management data. Silent persistence is risky because users and orchestrators may assume the tool only prints to stdout, while sensitive operational metadata is actually left behind on disk in a shared temporary location.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: Writing memory-review metadata to a predictable `/tmp/cmm_review_report.json` path is an unjustified external persistence channel. In a context-memory skill, this is especially sensitive because filenames, project structure, and review scope may reveal private conversational or project information, and a predictable temp filename also increases exposure to tampering or unintended reads by co-tenant processes.

Static analysis

No suspicious patterns detected.