Security audit

Memory Hub

Security checks for vulnerabilities and agentic risk

Overview

This skill intentionally syncs shared agent memory through a user-chosen Git repository; the privacy risks are real but disclosed and aligned with its purpose.

Install only if you want long-lived shared memory across agents. Use a private repository you control, avoid secrets and highly sensitive personal details, review USER.md/RULES.md/TOOLS.md periodically, and ask the agent to show exact changes before committing or pushing important memories.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The documentation promises AGENTS.md is modified only after user confirmation, but the provided installation invocation exposes no visible confirmation control. If the script performs the change automatically, it can silently alter future agent behavior and persistence expectations.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrase "记住这个" is broad enough to appear in ordinary conversation, making unintended activation of the write flow plausible. In this skill, accidental invocation can persist user data to a shared GitHub repository, increasing both privacy and integrity risk.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The automatic sync condition "心跳时自动检查" is underspecified, so agents may sync at unpredictable times without clear user awareness. Because syncing reads and updates shared memory and local cache, ambiguous activation increases the chance of unintended network access and background data propagation.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill encourages storing preferences, habits, and knowledge in a GitHub repository but does not prominently warn that this transfers potentially sensitive data off-device. Users may reasonably underestimate the privacy consequences, especially since the repository is shared across agents and persists over time.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The skill is designed to persist and share the owner's preferences, habits, and communication style across multiple agents. This creates a centralized, durable profile of personal behavior that can be over-collected, misused by other agents, or exposed if the repository or credentials are compromised.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The read workflow instructs agents to load all shared memory files into context, including user information, rules, and tools, regardless of immediate need. Broad ingestion increases unnecessary exposure of sensitive or influential content and amplifies prompt-injection risk from repository contents.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The write workflow directs agents to record and push new user preferences and other memories into a multi-agent shared repository. This is sensitive-data persistence with network transmission, and mistakes or prompt-triggered writes can create durable privacy leakage across systems and future sessions.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The classification guide explicitly instructs storing the owner's preferences, habits, and communication style in shared storage. That normalization of personal-profile sharing makes the privacy risk integral to the skill rather than incidental, especially in a multi-agent environment.

Static analysis

No suspicious patterns detected.