zwjh-skill

• Outcome: Review
• Latest audit: Aug 24, 2026 · 12:36 PM UTC
• Version: 2.5.0

Overview

The skill is a coherent memory system, but it needs Review because it creates recurring tasks, exposes local memory services, and contradicts its own no-network claims.

Install only if you intentionally want a persistent local memory and knowledge-graph system. Before running setup, review the exact cron or schtasks entry, avoid storing secrets unless you accept long-term retention, treat backups and snapshots as sensitive, and be aware that the web UI, tokenizer loading, external LLM adapters, and Baidu backup path can cross the local-only boundary.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (40)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

f'/sc daily /st {trigger} /f /rl LIMITED'
        )
        try:
            proc = subprocess.run(schtasks, shell=True, capture_output=True, text=True)
            ok = proc.returncode == 0
            return {"ok": ok, "platform": "windows", "command": schtasks,
                    "output": (proc.stdout or proc.stderr)[:300], "plan": plan["tier"]}

• Confidence: 88% confidence
• Finding: The Windows task creation path builds a shell command string and executes it with shell=True. Although most inputs are internally derived, the command embeds executable and script paths whose quoting/escaping is fragile; if installation paths or environment context are attacker-influenced, this can enable command injection or unintended command execution while creating a persistent scheduled task.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 已存在，先移除旧行
                existing = _strip_old(existing)
            new_cron = existing + f"# {TASK_NAME_MARKER}\n" + line
            proc = subprocess.run(["crontab", "-"], input=new_cron,
                                  capture_output=True, text=True)
            ok = proc.returncode == 0
            return {"ok": ok, "platform": "unix", "line": line,

• Confidence: 84% confidence
• Finding: This writes a newly constructed crontab entry that causes recurring execution of the skill's autopilot command. The subprocess call itself is not injection-prone, but it is part of an unauthorized persistence mechanism because it modifies OS-level scheduling without any confirmation or trust boundary checks.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cur = subprocess.run(["crontab", "-l"], capture_output=True, text=True)
            existing = cur.stdout if cur.returncode == 0 else ""
            new_cron = _strip_old(existing)
            proc = subprocess.run(["crontab", "-"], input=new_cron,
                                  capture_output=True, text=True)
            return {"ok": proc.returncode == 0, "platform": "unix"}
        except Exception as e:

• Confidence: 83% confidence
• Finding: Writing the modified crontab is a sensitive system-configuration action that can remove persistence entries without prompting the user. The subprocess pattern itself is safe, but the overall behavior is security-relevant because it alters OS scheduler configuration silently.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises substantial capabilities including file read/write, shell execution, local servers, scheduled tasks, and optional networked integrations, yet declares no permissions. This undermines least-privilege review and can cause users or hosting platforms to grant trust without understanding that the skill can persist data, execute OS task registration, and potentially contact external services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The description emphasizes a pure-local memory foundation, but the documented behavior expands into MCP tool serving, HTTP/REST serving, scheduled-task persistence, multimodal indexing, import/export, optional external LLM adapters, and possible remote update/model flows. This mismatch can mislead users into approving installation under a narrower trust model than the actual operational surface, increasing the risk of unintended persistence, data exposure, or network interaction.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The tokenizer loader falls back to AutoTokenizer.from_pretrained("BAAI/bge-small-zh-v1.5", cache_dir=MODEL_DIR), which can trigger outbound network access and remote artifact retrieval at runtime. In a skill advertised as pure local and zero-key, this creates an unexpected supply-chain and privacy boundary violation: using the feature may contact an external service and ingest unpinned remote content.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The header comments claim package-provided SHA256 verification, but the implementation only verifies the model if a sidecar .sha256 file exists; otherwise any file at MODEL_PATH is accepted. The hardcoded MODEL_SHA256 value is a placeholder and is never enforced, so users may believe integrity is guaranteed when in practice tampered or substituted model files can be loaded.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: `safe_read` is not read-only: when a non-UTF-8 decoding succeeds, it immediately rewrites the original file in UTF-8. A caller expecting a harmless read can therefore trigger unexpected modification of user data, potentially changing file bytes, metadata, line endings, or corrupting files that should not be rewritten in place. In a memory/logging skill that processes user files, this side effect is more dangerous because routine analysis paths may silently alter persistent records.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The module documentation promises that only descriptions and associations are stored, but the implementation persists full local file paths in `media_memories.file_path` and also includes paths in generated descriptions and linked memory text. File paths can reveal usernames, directory structures, project names, mount points, and other sensitive local context, creating a privacy and data-minimization issue and violating the documented trust boundary.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The module grants the skill the ability to create, query, and delete OS-level scheduled tasks via schtasks/crontab. That expands the capability surface beyond passive memory management into persistence and system administration, which is dangerous in agent-skill contexts because it enables recurring execution and harder-to-notice background behavior.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The web server exposes operational setup, health, and archive telemetry through unauthenticated endpoints even though the stated purpose is knowledge-graph visualization and memory retrieval. This broadens the attack surface and can leak internal state, maintenance status, storage/archive characteristics, or other metadata useful for reconnaissance by any local process or browser page that can reach the service.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The `/api/task-status` and `/api/archive-stats` routes are exposed with no authentication, and the server also permits cross-origin reads via `Access-Control-Allow-Origin: *`. Even on localhost, this allows untrusted local software or potentially a malicious website running in the user's browser to query sensitive internal status data, increasing information disclosure risk.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The page fetches executable JavaScript from a third-party CDN despite the skill being advertised as 'pure local' and 'zero key'. This creates a supply-chain and privacy boundary violation: the CDN request reveals local usage metadata and, if the remote script is tampered with or unavailable, the UI can execute untrusted code or fail unexpectedly.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrase '帮我配置 + 设置定时任务' is ordinary conversational language and the document says the AI will 'automatically complete everything.' Broad natural-language triggers increase the chance of accidental invocation, causing the agent to register persistence mechanisms or modify the local environment without sufficiently explicit, informed consent.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: Telling users that 'most of the time' they only need to say a generic phrase encourages implicit activation without clear trigger boundaries. In a skill that can create scheduled tasks, persist conversation-derived memory, and expose services, ambiguous invocation materially raises the risk of unintended side effects.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The one-click setup flow emphasizes convenience and automation while downplaying that it will create a persistent daily scheduled task. Persistent unattended execution changes the system state and can repeatedly process user data, so failing to foreground that behavior weakens informed consent and increases the risk of unwanted long-term collection or execution.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The restore command performs a state-changing recovery operation immediately with no confirmation, preview, or safety interlock. In a memory/knowledge-base tool, restore can overwrite current local data, reintroduce stale or attacker-supplied state, or unintentionally import logs, causing integrity loss and privacy issues if the wrong path is provided.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The autopilot command chains multiple side-effecting actions—indexing logs, analysis, report generation, archiving, optional backup, and update checks—without a clear upfront summary or confirmation. In this skill context, that is more dangerous because the tool handles long-term memory data, so hidden writes, archival moves, backups, and network contact can affect confidentiality, integrity, and user trust in a single command.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The resolver automatically marks existing facts as superseded and commits the change for UPDATE and CORRECTION classifications without requiring explicit user confirmation at the destructive update point. In a long-term memory skill, misclassification or crafted input could silently alter persistent memory state, causing integrity loss, incorrect downstream retrieval, and difficult-to-notice data tampering across sessions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The call site can implicitly download tokenizer assets from Hugging Face without a clear warning to the user or caller. This is risky because it causes hidden network activity, may leak operational metadata, and expands the trusted code/data boundary to remote content during normal execution.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The snapshot() function exports a complete backup containing entities, relations, facts, memories, and configuration to a JSON file on local disk with no confirmation, redaction, encryption, or permission hardening visible in this file. In a persistent-memory skill, this materially increases privacy and data-exposure risk because highly sensitive conversation history and graph data can be written to an easily copied file.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The function silently rewrites file content to UTF-8 during what appears to be a read operation, with no user notice or confirmation. Silent in-place mutation of files can violate user expectations, damage forensic integrity of logs, and cause data loss or compatibility issues with tools that depend on the original encoding.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The MCP server exposes a tool that writes arbitrary caller-supplied text into persistent long-term memory with no confirmation, authorization check, consent gate, or provenance restriction in this file. In the context of a cross-skill memory bus, any connected agent or skill that can invoke the tool may silently persist sensitive data, prompt-injected content, or poisoned knowledge that influences future retrieval and downstream agent behavior across sessions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code assembles project memories, facts, and relationship data into a prompt and sends it to a pluggable LLM adapter with no consent gate, redaction, or guarantee that the adapter is local-only. In this skill’s context, the data is explicitly long-term personal memory and relationship graph material, so forwarding it to an external model can expose sensitive personal or organizational information.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The knowledge-growth flow collects raw memory rows and related entities matching a topic, serializes them to JSON, and passes them directly to the LLM. Because the skill is a persistent memory system, those raw memories may contain sensitive notes, habits, work details, or personal information that could be disclosed to a third-party model without the user realizing it.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.