Security audit

Memory Pro

Security checks for vulnerabilities and agentic risk

Overview

This memory skill is transparent about saving long-term notes, but it can proactively store private conversation details and commit them to Git without clear user approval.

Install only if you intentionally want proactive long-term memory. Require the agent to show the exact note and destination before saving, approve each write and Git commit, exclude secrets and sensitive personal details, and periodically review or remove saved notes and Git history.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The skill advertises broad trigger words like 'skill' and '优化', which are common in ordinary conversation and can cause unintended activation. In this skill's context, accidental activation is more dangerous because activation can lead to persistence actions such as writing notes and committing data to version control.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The activation conditions include routine events like '会话结束', '重要发现', '决策时刻', and broad user statements, giving the agent wide discretion to persist conversation-derived content without a narrowly scoped request. Because this skill is specifically designed to extract and store long-term memory, ambiguous activation materially increases the chance of over-collection and unintended retention of sensitive data.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill instructs the agent to create/update files under notes/ and then run git add/commit, but it does not require user notice, consent, or any safeguard around persistence and system modification. This is dangerous because users may not realize their conversation-derived data is being written to disk and preserved in version history, where deletion and access control become harder.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The skill directs the agent to proactively retain user preferences, decisions, and error-derived lessons from ordinary conversation into long-term memory. In context, this creates a privacy and data-minimization problem because the agent is encouraged to infer what should be remembered rather than only storing information the user explicitly authorized.

Ssd 3

High

Confidence: 99% confidence
Finding: The routing table explicitly sends user preferences, style conventions, and relationship/person information into persistent notes files such as USER.md and notes/people/. This is especially risky because it operationalizes storage of personal data categories and social context, increasing the likelihood of privacy violations, profiling, or later misuse if the repository is shared or compromised.

Ssd 3

High

Confidence: 99% confidence
Finding: The skill instructs the agent to archive distilled conversation content into git history, which creates durable, replicated retention and makes later removal difficult. In context, version control significantly amplifies risk because accidental storage of sensitive content can persist across commits, remotes, backups, and collaborator clones.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The skill treats many ordinary phrases like '这个以后还会用到' and '记住这个偏好' as signals to store future-use information, which broadens collection based on conversational implication rather than explicit informed consent. This is dangerous because users may be speaking casually, while the agent interprets those statements as authorization for persistent storage.

Static analysis

No suspicious patterns detected.