Security audit

Self-Evolving Memory

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local memory-management skill, but it needs review because it can persist behavior-shaping memory and its secret-file scanner can miss some plaintext credentials.

Review this before installing if you will let it write persistent agent memory. Use it only in a workspace where you control the memory files, inspect behavioral rules before they are auto-loaded, avoid storing real secrets in SECRET.md, and do not rely on the included scanner as the only credential-safety control until the Markdown-line bypass is fixed.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Error

Location: references/01-layered-storage.md:196
Finding: Persistent Instruction Injection Through Automatically Loaded Memory
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/secret_control.py:54
Finding: Plaintext Credential Detection Bypass Through Ignored Markdown Lines
Content: View full analysis
Finding | None: if not line.strip() or line.lstrip().startswith(("#", ">")): return None # A sanctioned locator may appear after a descriptive `secret`/`token` # label. Remove only that non-sensitive locator before testing the remaining # text, so the migration helper's own output scans clean while any trailing # credential material is still detected. without_locators = LOCATOR.sub("", line) assignment = ASSIGNMENT_VALUE.search(without_locators) if assignment: return Finding("assignment_value", line_number, _bucket(assignment.start() + 1)) credential = KNOWN_CREDENTIAL.search(without_locators) if credential: return Finding("credential_pattern", line_number, _bucket(credential.start() + 1)) return None ``` ### Technical Analysis The scanner returns immediately for every non-empty line whose first non-whitespace character is `#` or `>`. This treats Markdown headings and blockquotes as inherently safe without examining their contents. A plaintext credential can therefore evade both `ASSIGNMENT_VALUE` and `KNOWN_CREDENTIAL` by appearing on an ignored line. Examples include: ```markdown > API Key: sk-examplecredential123456 # password: sensitive-value ``` This is especially relevant because `SECRET.md` is a Markdown file and its template legitimately uses blockquotes. An accidental or malicious user can place credential material in the same syntax and receive a `clean_locator_only` result. The helper's public result is intentionally redacted, which is appropriate, but the correctness of that safe result depends on complete local scanning. Here, the result can incorrectly certify a file containing plaintext credentials. ### Attack Path 1. A ...[truncated 1414 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/migrate_secret.py:107
Finding: Time-of-Check to Time-of-Use Race in Secret Migration
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (38)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Handling SECRET.md, scanning for credential patterns, and enforcing chmod 0600 are materially different from ordinary memory-organization tasks and affect sensitive assets. In this skill context, that makes the mismatch more dangerous because users invoking a memory skill may not realize they are authorizing operations over credential stores and file permissions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Handling SECRET.md, scanning for credential patterns, and enforcing chmod 0600 are materially different from ordinary memory-organization tasks and affect sensitive assets. In this skill context, that makes the mismatch more dangerous because users invoking a memory skill may not realize they are authorizing operations over credential stores and file permissions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Handling SECRET.md, scanning for credential patterns, and enforcing chmod 0600 are materially different from ordinary memory-organization tasks and affect sensitive assets. In this skill context, that makes the mismatch more dangerous because users invoking a memory skill may not realize they are authorizing operations over credential stores and file permissions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Handling SECRET.md, scanning for credential patterns, and enforcing chmod 0600 are materially different from ordinary memory-organization tasks and affect sensitive assets. In this skill context, that makes the mismatch more dangerous because users invoking a memory skill may not realize they are authorizing operations over credential stores and file permissions.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: The presence of self-rewrite behavior is materially risky because the skill is explicitly designed to modify agent memory and self-referential state, including growth-journal, user, and relationship artifacts. Even though the eval mentions guardrails and excludes SOUL.md, self-modification mechanisms can amplify errors, persist poisoned inputs, or entrench manipulated beliefs if activation, evidence gating, or rollback controls fail.
Content: Scanner excerpt · evals/evals.json (reported line 24)May include surrounding context.
json
"id": 2, "category": "primary-path", "prompt": "记忆巩固怎么执行？我要跑一次每日巩固", "expected_output": "Describes the four-phase consolidation flow (Phase 0 safety guard / snapshot backup, Phase 1 fact consolidation / scan+score+promote, Phase 2 self-rewrite / growth-journal+user+relationship update, Phase 3 validation and rollback). References the consolidation manual.", "files": [ "references/03-consolidation-guard.md", "references/09-consolidation-manual.md"

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest describes a mentor skill for layered agent memory management, consolidation, promotion, rollback, indexing, and retrieval planning using local files and optional semantic retrieval. This script instead scans and rewrites a SECRET.md file, validates secret-migration plans, and replaces plaintext secrets with secret:// locators, which is a separate secret-handling capability not justified by the memory-system description.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file begins with a Chinese heading ('版本历史') even though the rest of the changelog includes mixed English terminology, and there is no indication that Chinese is optional or required for a specific regional/compliance reason. This creates a natural-language locale policy concern because the skill documentation implicitly imposes a language choice without user opt-in.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill advertises operational capabilities involving local files, optional retrieval, and deployment workflows, but it declares no explicit tool scope or permissions. For an agent skill, missing scope boundaries can cause the host to grant broader-than-necessary access or make reviewers unable to verify whether file, shell, or network operations are intended, increasing the risk of unauthorized filesystem changes or data exposure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file consistently mandates Chinese-language interaction in its natural-language instructions and descriptions, but does not state that this skill is region-specific or provide user opt-in for language selection. This can violate organizational language/locale policy when skills are expected to be usable without forcing a specific language.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Phrases like "主动探索与认知拉伸", "自我认知演化", "Agent 反思自己", and similar conceptual language are ambiguous and may match broad reflective or advisory discussions rather than deliberate requests to run a memory-management skill. In a skill that can initialize, repair, consolidate, roll back, or retrieve memory, ambiguous activation expands the chance of unintended execution and unsafe state changes.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrases "记住这条" and "记一下" are broad, everyday expressions that can appear in normal conversation without any explicit intent to invoke this skill. Because this skill performs memory operations, accidental activation could cause unintended recording, consolidation, or other stateful actions that affect agent memory and privacy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown template uses Chinese-only headings and instructions, which imposes a specific language on users. The file does not indicate that the language is optional, configurable, or limited to a justified region-specific context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown template is written entirely in Chinese and provides no indication that language selection is optional or tied to a justified region-specific use case. That can constitute a language/locale policy violation because it implicitly requires use of a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file's visible user-facing content is entirely in Chinese, including the title and template labels, with no indication that the user can choose another language or that the skill is intentionally restricted to a Chinese-language context. This creates a natural-language policy concern because it implicitly enforces a specific locale without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The user-facing policy text in lines L3-L5 is written only in Chinese, which imposes a specific language for understanding the skill file without offering any language choice or opt-in. The rules require flagging language or locale policy violations when a skill forces a specific language without user choice or clear justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file is entirely written in Chinese and defines core identity instructions in that language without any indication that language selection is optional or user-driven. This can violate a language/locale policy requiring user choice or opt-in rather than imposing a fixed language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The entire template is written in Chinese and does not indicate that users may choose another language or locale. Under the policy, language constraints should be optional or clearly justified; this file provides neither.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Lines L03-L05 state user-facing positioning guidance entirely in Chinese and describe the file as material for users/readers, but there is no indication that Chinese is optional or that the skill is region-specific. This creates a natural-language policy concern because it imposes a specific language on user-facing content without opt-in.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The eval at this location uses a broad, natural-language trigger phrase that is likely to appear in ordinary conversation, which can cause the skill to activate when the user is merely chatting rather than intentionally invoking memory operations. In a skill that can write to persistent memory, unintended activation increases the risk of unauthorized recording, misrouting, or state changes based on ambiguous user input.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This generic activation phrase is dangerous because it can be satisfied by many unrelated user requests, causing the skill to trigger outside its intended scope. Since this skill governs persistent agent memory and related workflows, accidental invocation can lead to inappropriate memory writes, secret-handling paths, or transactional recovery flows being entered without clear user consent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Urgent everyday wording like this is especially collision-prone because users commonly say 'quickly remember this' or similar phrases in ordinary dialogue. In the context of a self-evolving memory skill, such vagueness can silently convert casual statements into persisted memory entries, making the risk higher than in a read-only assistant skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The entire skill specification is written in Chinese and includes prescribed user-facing trigger phrases and operational instructions only in Chinese, with no indication that the user may choose another language. This creates a natural-language locale constraint without opt-in or justification, which matches the policy-violation category for language or locale restrictions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The entire skill document is written in Chinese and presents the protocol and file conventions exclusively in that language, with no indication that users may choose another language or that the skill is limited to a Chinese-language context. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown file presents all instructions and examples exclusively in Chinese, and it does not indicate that the user opted into that language or that the skill is limited to a Chinese-speaking context. Under the language/locale policy rule, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire skill document is written in Chinese and provides no indication that users may choose another language or that the locale restriction is intentional for a region-specific use case. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.