Security audit

Channel Activity

Security checks across malware telemetry and agentic risk

Overview

This is a plausible memory skill, but it needs review because it can share recent activity across channels and identities with weak consent and scoping controls.

Install only if you are comfortable with recent messages and identifiers being stored locally and reused across channels. Before production use, require explicit opt-in, verify same-user identity across channels, disable family sharing by default, remove hardcoded local paths, and decide whether MEMORY.md access or long-term promotion should be allowed at all.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (33)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill metadata declares no permissions, yet the analyzed behavior indicates file read and file write capabilities. Undeclared filesystem access is risky because it prevents informed consent and review, and in a memory-oriented skill it could expose or modify local data outside the user’s expectations.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared purpose presents a simple short-term multi-channel memory skill, but the detected behavior is substantially broader: cross-identity sharing, long-term memory interaction, mutation operations, and automatic context injection. This mismatch is dangerous because reviewers and users may grant or install the skill under false assumptions, enabling covert access, persistence, and propagation of sensitive context across channels or identities.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill metadata describes short-term multi-channel memory, but the implementation adds family-group management that enables cross-identity data association and later sharing. This is dangerous because it expands the trust boundary beyond the declared purpose, making it easier for users' recent activity to be exposed to other identities without clear authorization expectations.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: This code aggregates and returns recent message summaries from other family members to the current identity, which is a direct confidentiality risk. In a memory skill, exposing other users' activity across identities can leak private conversations, habits, or sensitive operational context, especially because summaries are derived from raw messages and shared automatically.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill is presented as short-term multi-channel memory, but it also loads and exposes long-term memory from MEMORY.md through get_complete_context() and query(). This expands the data-access scope beyond the apparent feature boundary, increasing the risk of unintended disclosure of older sensitive information to callers that expected only short-lived context.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The cache stores a direct user identifier together with task content, which creates unnecessary linkage between a person and their activity in what is described as short-term multi-channel memory. Even with a short TTL, this expands the data sensitivity of the component and increases privacy and data-handling risk if logs, backups, debugging output, or downstream memory promotion expose the entry.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The setting "upgrade_to_long_term": true contradicts the stated purpose of short-term memory and creates a path for transient conversation data to become persistent storage. This is dangerous because users and integrators may rely on the short retention model, while sensitive channel activity can silently outlive the TTL and be retained beyond the declared scope.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill is described as providing multi-channel short-term memory, but this function reads an unrelated long-term memory file from a fixed path and returns its raw contents with only truncation. That expands data access beyond the stated purpose and can leak sensitive notes, credentials, or personal context from MEMORY.md into prompts or outputs, especially because the path is hard-coded and silently read whenever called.

Intent-Code Divergence

Low

Confidence: 84% confidence
Finding: The docstring claims to return a summary of long-term memory, but the implementation simply returns raw file content after truncation from the end. This mismatch is dangerous because callers may trust that sensitive material has been summarized or minimized when in fact verbatim secrets or private notes can still be exposed to downstream models, logs, or users.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The document explicitly recommends automatically calling a hook before every reply and injecting cross-channel activity into the prompt context, but it provides no consent model, privacy notice, or access-control boundary. In a multi-channel assistant, this can expose sensitive user content shared in one platform to another platform or participant context without the user's awareness.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README explicitly describes storing cross-channel user identifiers and message content and using them for unified management and context merging, but it does not mention consent, minimization, access controls, or privacy boundaries. In a multi-channel assistant, this can enable unintended correlation of a person's activity across platforms and expose sensitive content if the cache is read, logged, or mishandled.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The README advertises promotion of short-term memory into long-term memory without warning users that transient content may become persistent. This is dangerous because users may share information expecting one-minute retention, while the system may preserve it indefinitely, creating privacy, compliance, and sensitive-data retention risks.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README explicitly describes storing recent message summaries and user IDs, and sharing those summaries across channels, but does not mention consent, access controls, retention safeguards beyond TTL, or privacy implications. In a multi-channel assistant, this can lead to unintended disclosure of one channel's user content or identifiers to another context or user.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation explicitly says expired temporary memory is automatically written into MEMORY.md as permanent memory, but provides no notice, consent flow, retention policy, or sensitivity limits. This creates a real privacy and data-governance risk because users may disclose content in one channel expecting it to be short-lived, while the system silently retains it long-term.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide instructs the assistant to retrieve and present recent activity from other channels as conversation context, but does not establish any consent boundary, identity verification, or privacy warning. That is a genuine cross-context data disclosure issue because information shared in Feishu may be surfaced in QQ without the user's informed expectation or authorization checks.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The retrieval interface enables AI-directed sharing by default with ai_decision=True, creating a permissive default for cross-user disclosure. A default-open sharing model without explicit consent or warning is dangerous because it makes privacy violations easy to trigger accidentally and hard for users to anticipate.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code persists user content, channel identifiers, context, and user IDs to a local JSON file without any notice, consent flow, minimization, or protection mechanism. If the workspace is shared, backed up, or readable by other processes, sensitive conversational data and identifiers can be exposed or retained longer than users expect.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The configuration defines storage behavior such as TTL, cleanup, and long-term upgrade, but does not express clear trigger scope, activation constraints, or data eligibility rules for what may be memorized. In a multi-channel assistant, unclear memory boundaries can cause over-collection or unintended retention of sensitive user content from channels where users did not expect persistence.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The hook is explicitly designed to automatically pull context from other channels before replying, which can disclose information from one conversation into another without the user's knowledge or consent. In a multi-channel memory skill, this creates a real privacy and data-boundary risk because messages from Feishu and QQ may have different audiences, expectations, or sensitivity levels.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The module persists arbitrary memory content, user IDs, and context to a local JSON file in plaintext without access controls, encryption, or any explicit consent/warning mechanism. In an assistant memory skill, stored content is likely to include sensitive conversational data, so local compromise, backup leakage, or accidental file exposure can disclose private user information.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Printing remembered content to stdout can expose sensitive user data in logs, terminals, process supervisors, or centralized log collectors. Because this module stores arbitrary user content, even a benign debug print becomes a natural data leakage channel in production environments.

Ssd 3

Medium

Confidence: 96% confidence
Finding: This section instructs the system to combine session history, long-term memory, and temporary cross-channel context into every reply path. That creates a direct data-flow for user-provided content from one channel to appear in another, which is especially dangerous when channels have different audiences, identities, or confidentiality expectations.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The usage example normalizes a workflow where a message from Feishu is later recalled and revealed in QQ, demonstrating actual cross-channel disclosure behavior rather than a theoretical capability. Because the skill is specifically designed as short-term memory across channels, the surrounding context makes the issue more dangerous: leakage is a core feature, not an edge case, and users may reasonably expect channel boundaries to be preserved.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The core feature is to expose recent activity from other channels in the current conversation, which creates a direct cross-context data leakage risk. If channel identity is not strongly bound to the same authorized user, the assistant may reveal content from one platform to a different user or audience.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The example normalizes behavior where the AI repeats a user's prior message from another channel back into the current session. This is dangerous because it demonstrates and encourages cross-channel disclosure as intended functionality, even though channel participants, identities, or privacy expectations may differ.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.