Security audit

Perstate

Security checks across malware telemetry and agentic risk

Overview

This is a coherent git-backed memory skill, but it needs review because it can persist conversation-derived knowledge locally and remotely with broad triggers and limited consent controls.

Install only if you want an agent memory system that may write conversation-derived knowledge to a git repo and push it using your git credentials. Use a dedicated private repository, avoid saving secrets or regulated data, prefer explicit /perstate commands over automatic save behavior, review generated changes before commit/push when possible, and be aware that the graph viewer contacts third-party CDNs when opened.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: Claiming that `/perstate` has 'no side effects' is misleading when documented read/status flows may automatically perform `git pull` or synchronization and modify local state. Users and agents may invoke the command under the assumption it is safe for inspection only, causing unintended network activity, repository mutation, or trust-boundary crossing.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The skill explicitly permits using an arbitrary local path as the backing repository and will auto-run git initialization if that path is not already a repo. That exceeds a narrow memory role and can mutate unexpected filesystem locations, potentially creating repos, metadata, and commits in directories the user did not intend to hand over for modification.

Context-Inappropriate Capability

Low

Confidence: 72% confidence
Finding: The `view` command is documented to auto-open a browser, which is an unnecessary side effect for a persistence skill and can trigger external application execution without fresh consent. While lower severity, launching a browser expands the skill's effective capability surface beyond storage and retrieval.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The generated HTML unconditionally loads JavaScript from third-party CDNs, which creates external network access and executes remote code in the user's browser. For a local memory-graph viewer, this expands trust to external providers and enables dependency compromise, tracking, or unexpected data exposure through browser requests.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README describes scanning conversation context, auto-extracting insights, and persisting them to git-backed storage that may be remote, without a strong privacy warning or explicit consent flow. In an agent setting, this can lead to long-term retention and synchronization of sensitive user data, secrets, or regulated information beyond the user's expectations.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The documentation includes destructive delete and prune operations such as `rm` and `rm -rf` without prominent warnings about irreversible loss or guardrails. In an agent-assisted environment, users may copy or trigger these operations without understanding that they can permanently remove knowledge graph content and related references.

Vague Triggers

High

Confidence: 96% confidence
Finding: The trigger phrases include very common language such as 'remember', 'recall', and 'memory', which can cause the skill to activate during ordinary conversation rather than clear command intent. In this skill, activation can lead to repository initialization, local writes, commits, pushes, and binding changes, so broad triggering materially raises the risk of unintended side effects and data persistence.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The command documentation describes state-changing behavior including writes, commits, pushes, branch operations, and deletions, but does not pair those actions with prominent user-facing warnings at the point of use. Users may reasonably interpret a memory skill as passive recall and not realize it can persist content remotely or remove data.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Initialization performs cloning, config writes under `~/.perstate`, worktree creation, and commit/push operations, yet the flow emphasizes skipping interactive confirmation with `--yes`. Because this may transmit conversation-derived content to a remote repository and alter local state, the lack of an explicit persistence and transmission warning is dangerous.

Vague Triggers

High

Confidence: 94% confidence
Finding: The trigger timing guidance instructs the agent to search at conversation start and save after 'high-dimensional insights,' using vague criteria rather than explicit user intent. That ambiguity is especially risky here because searches may expose persisted context and saves may commit and push derived conversation content without the user clearly requesting persistence.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This script performs security-relevant side effects automatically: it stages all changes with 'git add -A', creates a commit, pushes to the remote, and writes a sync cache file, but provides no interactive confirmation, dry-run mode, or explicit warning at the point of execution. In the context of an agent memory/persistence skill, this increases the risk of unintended publication of sensitive data or accidental modification of the repository state if invoked on the wrong worktree or with overbroad extracted content.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The script rewrites the user's ~/.perstate/config.yml session binding automatically, deleting any prior binding for the provided session ID and appending a new one without confirmation, backup, or atomic validation of the resulting YAML structure. In a persistence/memory skill, silently rebinding a session to a different branch can redirect future reads and writes, causing loss of continuity, state confusion, or accidental data corruption across agent sessions.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: This code copies the full contents of all entities/*.md files into a consolidated index file in the user's home directory. In the context of a memory/persistence skill, that can duplicate potentially sensitive notes into a secondary location with different retention, backup, and permission expectations, increasing exposure if the home directory is shared, backed up, or inspected by other local processes.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: By embedding CDN-hosted scripts, the viewer causes the browser to make outbound requests when the file is opened, but the script gives no explicit warning that a supposedly local visualization has network dependencies. In a memory tool that may visualize sensitive personal or project knowledge, silent network access increases privacy and supply-chain risk.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The documented `/perstate save` behavior instructs the agent to scan conversation context and persist extracted knowledge into long-lived storage. That materially increases the risk of storing sensitive user-provided information, hidden prompts, credentials, or confidential workflow data without sufficient minimization or consent.

Ssd 3

Medium

Confidence: 89% confidence
Finding: Promoting 'private knowledge' as persistent remote memory for agents creates a semantic pattern that encourages retention of potentially sensitive data over long periods. In a skill designed for agent memory, this context makes the data-handling risk more serious because persistence is the core feature rather than an incidental behavior.

Session Persistence

Medium

Category: Rogue Agent
Content: esac # --- 写入配置（幂等）--- mkdir -p ~/.perstate CONFIG=~/.perstate/config.yml if [ -f "$CONFIG" ]; then
Confidence: 77% confidence
Finding: The script persists repository and branch configuration under ~/.perstate/config.yml and builds a long-lived local state/worktree under ~/.perstate. In the context of a persistent-memory skill handling potentially sensitive user insights, this creates durable local retention that may expose private knowledge to other local users, backups, or later processes if file permissions are not restricted.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: | Create entity | `mkdir -p entities/<id>` + write entity.md | | Create relation | `mkdir -p entities/<from>/<type>` + write `<to>.md` | | Delete relation (hard) | `rm entities/<from>/<type>/<to>.md` | | Delete entity | `rm -rf entities/<id>/` + `find entities/ -name "<id>.md" -delete` | | Create worktree | `git worktree add <repo-dir>/<branch> <branch>` | | Remove worktree | `git worktree remove <repo-dir>/<branch>` | | Prune stale worktrees | `git worktree prune` |
Confidence: 76% confidence
Finding: The documented hard-delete pattern `rm -rf entities/<id>/` plus `find ... -delete` is highly dangerous in an agent skill because entity identifiers may ultimately originate from user or model-generated content. If the implementation mirrors this documentation without strict path validation and confinement, path traversal or malformed identifiers could cause arbitrary file deletion beyond the intended graph directory.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: README.md:143