Security audit

MemHub

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed personal memory manager that stores and optionally syncs a user-designated memory repository, with sensitive behavior aligned to that purpose.

Install this only if you want an agent to maintain cross-session memory for you. Point MEMHUB_REPO at a dedicated memory repository, review what gets remembered, and understand that after sync setup/onboard, reads may pull and writes may push on a throttle unless you choose manual sync or pass no-sync options. Do not paste tokens or OAuth codes into chat.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (31)

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: L004 的描述全文以中文规定技能用途与执行条件，且整个 SKILL.md 以中文面向代理行为说明，没有提供语言选择、双语支持或用户 opt-in。按规则，若技能在自然语言层面强制特定语言/locale 而无选择机制，应视为语言策略违规。
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.
md
- GitHub/Gitee remote 只是同步后端；YAML/Markdown 文件仍是可信源数据。 - 自动写入默认进入 canonical 记忆（本地提交，不自动推送）；低置信或需人工复核的才用 `--inbox`。 - `sync setup` 会触发授权、创建仓库、修改 remote；**只有用户明确要求配置/切换同步时才执行**。 - OAuth/token/SSH 凭据、authorization code、client secret、access token 都属于敏感信息；不要在回答中复述。 ### 对话开始：读取上下文

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 280)May include surrounding context.
md
- GitHub/Gitee remote 只是同步后端；YAML/Markdown 文件仍是可信源数据。 - 自动写入默认进入 canonical 记忆（本地提交，不自动推送）；低置信或需人工复核的才用 `--inbox`。 - `sync setup` 会触发授权、创建仓库、修改 remote；**只有用户明确要求配置/切换同步时才执行**。 - OAuth/token/SSH 凭据、authorization code、client secret、access token 都属于敏感信息；不要在回答中复述。 ### 对话开始：读取上下文

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 281)May include surrounding context.
md
- GitHub/Gitee remote 只是同步后端；YAML/Markdown 文件仍是可信源数据。 - 自动写入默认进入 canonical 记忆（本地提交，不自动推送）；低置信或需人工复核的才用 `--inbox`。 - `sync setup` 会触发授权、创建仓库、修改 remote；**只有用户明确要求配置/切换同步时才执行**。 - OAuth/token/SSH 凭据、authorization code、client secret、access token 都属于敏感信息；不要在回答中复述。 ### 对话开始：读取上下文

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/memhub.py (reported line 1532)May include surrounding context.
python
- GitHub/Gitee remote 只是同步后端；YAML/Markdown 文件仍是可信源数据。 - 自动写入默认进入 canonical 记忆（本地提交，不自动推送）；低置信或需人工复核的才用 `--inbox`。 - `sync setup` 会触发授权、创建仓库、修改 remote；**只有用户明确要求配置/切换同步时才执行**。 - OAuth/token/SSH 凭据、authorization code、client secret、access token 都属于敏感信息；不要在回答中复述。 ### 对话开始：读取上下文

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/memhub.py (reported line 1553)May include surrounding context.
python
- GitHub/Gitee remote 只是同步后端；YAML/Markdown 文件仍是可信源数据。 - 自动写入默认进入 canonical 记忆（本地提交，不自动推送）；低置信或需人工复核的才用 `--inbox`。 - `sync setup` 会触发授权、创建仓库、修改 remote；**只有用户明确要求配置/切换同步时才执行**。 - OAuth/token/SSH 凭据、authorization code、client secret、access token 都属于敏感信息；不要在回答中复述。 ### 对话开始：读取上下文

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.
md
否则用户会误以为在自动同步，实际没有。 - 若全绿或只有 `!` 提示，继续正常流程。 - doctor 是只读的、默认不联网（只有显式 `--network` 才探测 broker），开销很小；但仍只需每会话首次跑一次即可。 - doctor 会打印凭据存放位置；若仓库里还有旧版 `.memhub/secrets.yaml`，会提示可以删除。确认就绪后，直接读取 context。仅当用户已通过 setup/onboard 授权自动同步时， `context` 才会按节流阈值从远端拉取最新记忆：

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 360)May include surrounding context.
md
否则用户会误以为在自动同步，实际没有。 - 若全绿或只有 `!` 提示，继续正常流程。 - doctor 是只读的、默认不联网（只有显式 `--network` 才探测 broker），开销很小；但仍只需每会话首次跑一次即可。 - doctor 会打印凭据存放位置；若仓库里还有旧版 `.memhub/secrets.yaml`，会提示可以删除。确认就绪后，直接读取 context。仅当用户已通过 setup/onboard 授权自动同步时， `context` 才会按节流阈值从远端拉取最新记忆：

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/memhub.py (reported line 295)May include surrounding context.
python
否则用户会误以为在自动同步，实际没有。 - 若全绿或只有 `!` 提示，继续正常流程。 - doctor 是只读的、默认不联网（只有显式 `--network` 才探测 broker），开销很小；但仍只需每会话首次跑一次即可。 - doctor 会打印凭据存放位置；若仓库里还有旧版 `.memhub/secrets.yaml`，会提示可以删除。确认就绪后，直接读取 context。仅当用户已通过 setup/onboard 授权自动同步时， `context` 才会按节流阈值从远端拉取最新记忆：

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/memhub.py (reported line 1014)May include surrounding context.
python
否则用户会误以为在自动同步，实际没有。 - 若全绿或只有 `!` 提示，继续正常流程。 - doctor 是只读的、默认不联网（只有显式 `--network` 才探测 broker），开销很小；但仍只需每会话首次跑一次即可。 - doctor 会打印凭据存放位置；若仓库里还有旧版 `.memhub/secrets.yaml`，会提示可以删除。确认就绪后，直接读取 context。仅当用户已通过 setup/onboard 授权自动同步时， `context` 才会按节流阈值从远端拉取最新记忆：

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/memhub.py (reported line 1056)May include surrounding context.
python
否则用户会误以为在自动同步，实际没有。 - 若全绿或只有 `!` 提示，继续正常流程。 - doctor 是只读的、默认不联网（只有显式 `--network` 才探测 broker），开销很小；但仍只需每会话首次跑一次即可。 - doctor 会打印凭据存放位置；若仓库里还有旧版 `.memhub/secrets.yaml`，会提示可以删除。确认就绪后，直接读取 context。仅当用户已通过 setup/onboard 授权自动同步时， `context` 才会按节流阈值从远端拉取最新记忆：

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/memhub.py (reported line 1090)May include surrounding context.
python
否则用户会误以为在自动同步，实际没有。 - 若全绿或只有 `!` 提示，继续正常流程。 - doctor 是只读的、默认不联网（只有显式 `--network` 才探测 broker），开销很小；但仍只需每会话首次跑一次即可。 - doctor 会打印凭据存放位置；若仓库里还有旧版 `.memhub/secrets.yaml`，会提示可以删除。确认就绪后，直接读取 context。仅当用户已通过 setup/onboard 授权自动同步时， `context` 才会按节流阈值从远端拉取最新记忆：

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/memhub.py (reported line 2097)May include surrounding context.
python
否则用户会误以为在自动同步，实际没有。 - 若全绿或只有 `!` 提示，继续正常流程。 - doctor 是只读的、默认不联网（只有显式 `--network` 才探测 broker），开销很小；但仍只需每会话首次跑一次即可。 - doctor 会打印凭据存放位置；若仓库里还有旧版 `.memhub/secrets.yaml`，会提示可以删除。确认就绪后，直接读取 context。仅当用户已通过 setup/onboard 授权自动同步时， `context` 才会按节流阈值从远端拉取最新记忆：

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 359)May include surrounding context.
md
- 不要把真实 token、client secret、OAuth code 写进 `SKILL.md`、README、示例或提交历史。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 361)May include surrounding context.
md
- 不要把真实 token、client secret、OAuth code 写进 `SKILL.md`、README、示例或提交历史。

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · permissions.json (reported line 10)May include surrounding context.
json
"read": ["${MEMHUB_REPO}/**", "${SKILL_DIR}/**"], "write": ["${MEMHUB_REPO}/**"], "credentialWrite": ["${MEMHUB_SECRETS_DIR}/**"], "denied": ["${MEMHUB_REPO}/../**", "/**", "**/.env", "**/.git/config"], "pathEscape": "rejected: absolute paths and `..` sequences are refused" }, "shell": {

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/memhub.py (reported line 2103)May include surrounding context.
python
"read": ["${MEMHUB_REPO}/**", "${SKILL_DIR}/**"], "write": ["${MEMHUB_REPO}/**"], "credentialWrite": ["${MEMHUB_SECRETS_DIR}/**"], "denied": ["${MEMHUB_REPO}/../**", "/**", "**/.env", "**/.git/config"], "pathEscape": "rejected: absolute paths and `..` sequences are refused" }, "shell": {

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/memhub.py (reported line 2104)May include surrounding context.
python
"read": ["${MEMHUB_REPO}/**", "${SKILL_DIR}/**"], "write": ["${MEMHUB_REPO}/**"], "credentialWrite": ["${MEMHUB_SECRETS_DIR}/**"], "denied": ["${MEMHUB_REPO}/../**", "/**", "**/.env", "**/.git/config"], "pathEscape": "rejected: absolute paths and `..` sequences are refused" }, "shell": {

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
Content: Scanner excerpt · scripts/memhub.py (reported line 143)May include surrounding context.
python
check: bool = False, extra_env: dict[str, str] | None = None, ) -> subprocess.CompletedProcess[str]: env = os.environ.copy() if extra_env: env.update(extra_env) return subprocess.run(

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 68)May include surrounding context.
python scripts/memhub.py --repo "$MEMHUB_REPO" sync setup github --auth token --repo-name mymemhub

SSH fallback

python scripts/memhub.py --repo "$MEMHUB_REPO" sync setup github --auth ssh --remote-method ssh --owner --repo-name mymemhub --no-create

text
OAuth/token 保存在记忆仓库**之外**的本机目录（macOS 默认 `~/Library/Application Support/memhub/secrets/`，Linux 默认 `~/.local/state/memhub/secrets/`，可用 `MEMHUB_SECRETS_DIR` 覆盖），文件权限 0600、目录 0700。仓库因此永远不含凭据，clone 与同步也不会带走它们。

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 68)May include surrounding context.
python scripts/memhub.py --repo "$MEMHUB_REPO" sync setup github --auth token --repo-name mymemhub

SSH fallback

python scripts/memhub.py --repo "$MEMHUB_REPO" sync setup github --auth ssh --remote-method ssh --owner --repo-name mymemhub --no-create

text
OAuth/token 保存在记忆仓库**之外**的本机目录(macOS 默认 `~/Library/Application Support/memhub/secrets/`,Linux 默认 `~/.local/state/memhub/secrets/`,可用 `MEMHUB_SECRETS_DIR` 覆盖),文件权限 0600、目录 0700。仓库因此永远不含凭据,clone 与同步也不会带走它们。

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill text describes capabilities to read/write files, access environment variables, invoke git as an external command, and perform networked sync/OAuth flows, yet the front matter does not declare an explicit machine-readable tool scope such as permissions or allowed-tools. This creates a governance gap: runtimes and reviewers may under-enforce boundaries, allowing broader execution than users or orchestrators expect.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Trigger phrases like “记住这个”, “帮我记一下”, and “以后记得” are common conversational expressions and can cause the skill to activate on ambiguous user intent. In this skill's context, activation can lead to persistence of user data and later synchronization, so over-triggering risks unauthorized memory writes or privacy-invasive retention.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger condition “会话开始时需要读取用户长期记忆” is overly broad and effectively authorizes automatic memory access at session start. Because this skill manages cross-agent persistent memory, broad auto-read behavior can expose private historical data in contexts where the user did not explicitly request memory retrieval.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 78% confidence
Finding: The commands around sync setup and repository creation enable long-lived cross-session memory and remote propagation. In the context of an agent skill, that enlarges privacy impact if activation is ambiguous or if users misunderstand when data will be stored and synced.
Content: Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.
md
python scripts/memhub.py --repo ~/memhub-data sync setup github --repo-name mymemhub python scripts/memhub.py --repo ~/memhub-data sync setup gitee --repo-name mymemhub --broker-url https://<trusted-broker> python scripts/memhub.py --repo ~/memhub-data sync setup github --auth token --repo-name mymemhub python scripts/memhub.py --repo ~/memhub-data sync setup github --auth ssh --remote-method ssh --owner <login> --repo-name mymemhub --no-create python scripts/memhub.py --repo ~/memhub-data sync status python scripts/memhub.py --repo ~/memhub-data sync

Static analysis

No suspicious patterns detected.

Overview

A.I.G

SkillSpector

Natural-Language Policy Violations

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Ae1

Ae1

Credential Access

Credential Access

Credential Access

Env Variable Harvesting

Session Persistence

SSH fallback

Session Persistence

SSH fallback

Undeclared Tool Scope

Vague Triggers

Vague Triggers

Session Persistence

Static analysis