Ichiro-Mind

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:16 AM UTC
• Version: 1.0.0

Overview

This is a coherent persistent memory skill, but its CLI has a real code-execution flaw and its long-term memory storage lacks clear privacy and retention controls.

Install only after reviewing the CLI and persistence risks. Avoid storing secrets, credentials, private prompts, or regulated personal data in this skill until the CLI argument injection is fixed and the memory store has clear opt-in, deletion, retention, redaction, and storage-location controls.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/ichiro-mind.sh:111
• Finding: Arbitrary Python Code Execution Through CLI Argument Injection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/ichiro-mind.sh:111-116` and `scripts/ichiro-mind.sh:131-139` **Vulnerability Type**: User-controlled arguments interpolated into dynamically evaluated Python source **Risk Level**: High ### Vulnerable Code ```bash python3 -c " from core import IchiroMind mind = IchiroMind() mind.remember('$content', '$category') print(f'✅ Remembered: {content[:50]}...') " ``` ```bash python3 -c " from core import IchiroMind mind = IchiroMind() results = mind.recall('$query') print(f'\\n🔍 Recall results for \\'$query\\':') for i, r in enumerate(results[:5], 1): print(f' {i}. [{r.category}] {r.content[:60]}...') " ``` ### Technical Analysis The `remember` and `recall` functions copy command-line arguments into shell variables and then interpolate those variables directly into source code passed to `python3 -c`. Shell quoting does not make these values safe as Python string literals. An argument containing a single quote can terminate the intended Python string and introduce additional Python statements. The injected Python executes with the same operating-system identity and environment as the `ichiro-mind` process. This affects: - Memory content through `$content` - Memory category through `$category` - Recall queries through `$query` For example, a malicious argument can conceptually terminate the string, invoke `__import__`, run an operating-system command, and comment out the remainder of the generated line. No validation or encoding prevents this transition from data to executable Python syntax. ### Attack Path 1. An attacker causes a user, automation workflow, or agent to invoke: - `ichiro-mind remember <attacker-controlled-content>`, or - `ichiro-mind recall <attacker-controlled-query>`. 2. The shell script assigns the supplied value to `content`, `category`, or `query`. 3. The value is inserted verbatim between single quotes in the source passed to `python3 -c`. 4. A crafted quote closes ...[truncated 951 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all user-controlled interpolation into `python3 -c` source code. 2. Implement the CLI directly in Python with `argparse`, passing command-line values through `sys.argv` as data. 3. If the shell wrapper must remain, invoke a fixed Python module and pass arguments separately: ```bash python3 -m core_cli remember "$content" "$category" python3 -m core_cli recall "$query" ``` 4. In the Python entry point, read the values from `sys.argv` without using `eval`, `exec`, or generated source code. 5. Add regression tests containing single quotes, double quotes, newlines, semicolons, backslashes, Unicode, and Python-like payloads. 6. Run the CLI with the minimum required filesystem permissions and avoid exposing unrelated secrets through its environment. ]]>

T08 · Insecure Dependencies

Warning

• Location: package.json:16
• Finding: Python Runtime Incorrectly Declared as an npm Dependency<![CDATA[ ## Vulnerability Details **File Location**: `package.json:16-18` **Vulnerability Type**: Dependency confusion and unnecessary third-party package installation **Risk Level**: Medium ### Vulnerable Code ```json "dependencies": { "python": ">=3.9" } ``` ### Technical Analysis A dependency named `python` in `package.json` refers to a package from the npm registry; it does not declare that the operating system must provide Python 3.9 or later. Consequently, an npm installation may resolve and download an unrelated third-party npm package named `python`. This introduces code from an unnecessary dependency into the installation environment and creates a supply-chain trust relationship that is not required by the Skill's declared functionality. No lockfile is present in the reviewed project, so the exact resolved dependency artifact is not fixed by the repository. The audit did not establish that the current npm package is malicious; the vulnerability is the unnecessary and misleading dependency resolution that permits a compromised, transferred, or otherwise unsafe package to enter the installation path. ### Attack Path 1. A user or deployment service installs the Skill with npm-compatible package tooling. 2. The package manager interprets `python` as an npm package name rather than a runtime prerequisite. 3. The package manager resolves a matching version from its configured registry. 4. An unrelated or compromised package is downloaded into the dependency tree. 5. If that package contains executable lifecycle behavior, or if its exported functionality is subsequently invoked, its code runs within the installation or application environment. 6. That code receives the permissions available to the package manager or consuming process. Exploitation therefore depends on control or compromise of the resolved third-party package, but the project unnecessarily creates that attack path. ### Impact Assessment Potential impact is bounded by the privilege ...[truncated 483 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `python` entry from `dependencies`. 2. Document Python 3.9 or later as a host runtime prerequisite in `README.md` and installation documentation. 3. Use Python packaging metadata, such as `pyproject.toml`, to declare the supported Python version: ```toml [project] requires-python = ">=3.9" ``` 4. Declare actual Python libraries through the Python packaging ecosystem rather than npm. 5. Declare only genuine JavaScript dependencies in `package.json`. 6. Generate and review appropriate lockfiles for each package ecosystem used by the project. 7. Configure CI to reject unexpected dependency additions and audit resolved packages before release. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (23)

Self-Modification

High

• Category: Rogue Agent

Content

- [ ] Implement MCP interface

## Pending Actions
- [ ] Write SKILL.md
- [ ] Create Python core
```

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill clearly describes reading and writing persistent memory files such as SESSION-STATE.md and MEMORY.md, but it declares no explicit tool scope or permission boundaries. That creates an authorization gap where a host agent may grant broader file access than users expect, increasing the risk of unintended data reads, writes, or cross-workspace persistence.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The archive layer explicitly mentions long-term storage and cloud backup but does not warn about external storage exposure or the sensitivity of persisted memory. Moving agent memory into durable or remote storage expands the blast radius of any accidental capture, compromise, or misconfiguration.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This section promotes automatic memory capture and storage of user information without any privacy notice, consent flow, retention limit, or sensitivity guidance. In a memory skill, silent persistence of conversation-derived data can lead to collection of personal, confidential, or regulated information that users did not realize would be retained.

Session Persistence

Medium

• Category: Rogue Agent

Content

- [ ] Implement MCP interface

## Pending Actions
- [ ] Write SKILL.md
- [ ] Create Python core
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The skill encourages persistent capture of user-provided information across sessions as a core feature, which creates surveillance and over-retention risk if not bounded by consent and data-minimization rules. Because the content is framed as normal operation, an integrating agent may store far more conversational data than is necessary for the task.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: These use-case descriptions encourage broad automatic collection and long-term retention of user relationships, preferences, history, and accumulated knowledge without corresponding safeguards. In context, this makes the skill more dangerous because its purpose is persistent memory, so any weak privacy practice becomes systemic rather than incidental.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly promotes persistent storage of user preferences and long-term memories across multiple storage layers, but it does not provide any clear warning, consent mechanism, or retention limits. This is dangerous because agents may collect and retain personal or sensitive conversation data by default, increasing the risk of privacy violations, over-collection, and unintended disclosure if the memory store is accessed or misused.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The documented auto-capture behavior states that conversation text can be automatically ingested into vector memory, yet there is no accompanying warning that user content may be stored persistently. In the context of a memory skill designed for durable recall, this raises the likelihood that sensitive prompts, personal details, or confidential project information will be silently embedded and retained.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The HOT layer writes session state directly to disk in SESSION-STATE.md with no consent, disclosure, retention control, or filtering of sensitive values. In a memory skill whose purpose is to capture conversational state, this creates a real privacy risk because arbitrary user content may be persisted locally in plain text where other local users, backups, or tooling can access it.

Session Persistence

Medium

• Category: Rogue Agent

Content

return state
    
    def _save(self):
        """Save state to file (WAL protocol)"""
        md_content = self._to_md()
        self.filepath.write_text(md_content)

• Confidence: 95% confidence
• Finding: This file write persists session state to disk in a plain-text markdown file, creating durable storage of potentially sensitive conversational context. Because the code provides no warning, encryption, permission hardening, or opt-out, the persistence behavior is a legitimate privacy/security weakness rather than a false positive.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Neurons (memories)
        cursor.execute("""
            CREATE TABLE IF NOT EXISTS neurons (
                id INTEGER PRIMARY KEY,
                content TEXT NOT NULL,
                type TEXT,

• Confidence: 94% confidence
• Finding: The SQLite schema for neurons establishes persistent storage for memory content, meaning user-provided data is retained locally across sessions. In isolation database creation is normal, but in this skill's context it stores free-form memory content without consent, minimization, or protective controls, making it a real privacy-relevant issue.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The remember() path is explicitly designed to persist arbitrary caller-provided content across multiple storage layers and daily logs based only on importance thresholds, with no sensitivity classification, secret detection, or policy gating. In the context of an agent memory system, this is especially risky because users may unknowingly provide credentials, health data, internal prompts, or other sensitive material that will be retained and propagated.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The auto_capture() logic extracts preferences and decisions from free-form text and stores them automatically, which can silently convert casual conversation into retained profile data. This increases privacy and profiling risk because sensitive inferences can be captured without user awareness, and the skill context makes this more dangerous since persistent memory is the product's core behavior.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: The skill exposes both storage and retrieval primitives for arbitrary user content, making it straightforward for sensitive information placed into memory to be retrieved in later interactions. In a persistent memory system, that semantic design materially increases the risk of cross-session disclosure, especially if multiple tasks, users, or trust boundaries share the same memory backend.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The remember tool persists arbitrary user-provided content but gives no warning, consent flow, or data-handling boundary before storage. In a memory skill intended for agent use, this creates a real privacy and retention risk because secrets, personal data, or transient prompts may be stored unintentionally and later surfaced through recall.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The recall function returns full remembered content directly in plain text, with no masking, authorization check, or sensitivity filtering. If secrets, credentials, personal data, or internal instructions were ever stored, a simple query could exfiltrate them verbatim, making this more dangerous in a general-purpose persistent memory skill than in a narrowly scoped application.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The learning path stores decision, outcome, lesson, and optional context as persistent experience data without notifying the caller that these fields may be retained. Because these fields can easily contain sensitive operational history or personal information, silent retention increases the chance of privacy violations and later unintended disclosure.

Session Persistence

Medium

• Category: Rogue Agent

Content

init() {
    echo -e "${YELLOW}Initializing Ichiro-Mind...${NC}"
    
    # Create directories
    mkdir -p ~/.ichiro-mind/{backups,logs}
    
    # Initialize databases

• Confidence: 73% confidence
• Finding: The script initializes persistent storage under ~/.ichiro-mind and creates a SESSION-STATE.md file, which can retain potentially sensitive memory, context, or user data across sessions. In a memory-management skill, persistence is expected, but without explicit permissioning, retention limits, or access controls, stored data may be exposed to other local processes, backups, or unintended future use.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The top-level natural-language description presents the skill identity using a fixed Chinese label alongside the English name, with no indication that language or locale is configurable. For a general-purpose skill, hard-coded language presentation can violate language-choice policy when no opt-in or preference mechanism is provided.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"python": ">=3.9"
  },
  "optionalDependencies": {
    "openai": "^1.0.0",
    "lancedb": "^0.5.0"
  }
}

• Confidence: 40% confidence
• Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "optionalDependencies": {
    "openai": "^1.0.0",
    "lancedb": "^0.5.0"
  }
}

• Confidence: 40% confidence
• Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: Line L003 includes a Chinese-language title string as part of the user-facing script header, but the file does not indicate that Chinese is optional, selectable, or required for a region-specific purpose. This can violate language/locale policy expectations when a skill imposes a specific language without user opt-in.

Static analysis

No suspicious patterns detected.