詹明明·这个月钱去哪了

• Outcome: Review
• Latest audit: Sep 6, 2026 · 11:25 AM UTC
• Version: 0.2.6

Overview

This skill is focused on revenue attribution, but it reads shared memory and saves sensitive business conclusions automatically, so it should be reviewed before installation.

Install only if you are comfortable with this skill processing ledger/order/customer-level revenue data, reading shared general memory, and saving business conclusions for future use. Prefer a configuration that limits memory reads to the skill namespace, asks before saving sensitive details, redacts customer names and exact values where possible, and provides a way to inspect and delete stored records.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:20
• Finding: Overbroad Access to Shared Agent Memory## Vulnerability Details **File Location**: `SKILL.md`, line 20 **Vulnerability Type**: Least-privilege violation through cross-skill memory access **Risk Level**: Medium **Relevant snippet translated into English:** ```markdown First read `config.yaml` (if it cannot be read, explicitly state that the configuration is missing and stop; do not use example values as if they were the user's settings), then read `zmm/references/Interaction Specification.md` (...), and then read memory from `{config.paths.memory}/zmm-revenue/` plus `_general/`. ``` ### Technical Analysis The instruction directs the Agent to read both the Skill-specific memory namespace and a shared general-memory namespace. Revenue attribution only requires information associated with this Skill and the business records intentionally supplied for the current analysis. Unconditionally loading shared memory exceeds that minimum requirement. If the shared directory contains information produced by unrelated workflows, the Skill may receive confidential data that the user did not intend to disclose for revenue analysis. Because the directory is loaded as Agent memory, its contents may also influence the resulting analysis. The finding does not establish operating-system privilege escalation or malicious exfiltration. It is a least-privilege access-control issue within the Agent's configured memory environment. ### Attack Path 1. A user invokes the revenue-attribution Skill. 2. The Agent resolves `{config.paths.memory}` from the external configuration. 3. The Skill reads its own `zmm-revenue/` namespace. 4. The instruction additionally causes the Agent to read the shared `_general/` namespace. 5. Unrelated records stored by other workflows enter the active context. 6. Those records may be exposed in output or may improperly influence the attribution result. ### Impact Assessment The accessible scope is limited to data that the Agent's existing tools and con ...[truncated 361 chars]
• Remediation: ## Remediation Suggestions 1. Restrict default reads to `{config.paths.memory}/zmm-revenue/`. 2. Remove the unconditional instruction to load the shared `_general/` namespace. 3. If shared context is genuinely required, request explicit user approval before access. 4. Select only the individual shared records required for the current task instead of loading an entire directory. 5. Enforce filesystem or memory-store access controls so each Skill can access only its own namespace by default. 6. Record the source of every loaded memory item and prevent unrelated records from being reproduced in user-facing output. 7. Treat content from shared memory as untrusted data rather than executable instructions.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:233
• Finding: Persistent Storage of Sensitive Business Information Without Data-Protection Controls## Vulnerability Details **File Location**: `SKILL.md`, lines 233-242 **Vulnerability Type**: Insecure persistence of sensitive financial and customer-related information **Risk Level**: Medium **Relevant snippet translated into English:** ```markdown ## Memory Before finishing, verify: - Was the attribution conclusion later confirmed or disproved? Record it as an "effective method" or "discarded," including the time and numerical values. This is the Skill's only real calibration source. - Which accounting basis did the user correct, such as contract signing, shipment, payment received, treatment of returns, or tax inclusion? Record it as a "correction"; one accounting-basis error invalidates the entire analysis. - Which anomalies recur, such as annual seasonality or a major customer's payment schedule? Record them so they can be excluded first during the next analysis. Write the information to `{config.paths.memory}/zmm-revenue/`, checking for duplicates first. ``` ### Technical Analysis The Skill requires persistent storage of attribution outcomes, dates, numerical values, accounting conventions, seasonal patterns, and major-customer payment behavior. These records can constitute sensitive commercial information and may allow customer or business activity to be inferred over time. The persistence instruction does not require informed consent, data minimization, customer-name redaction, encryption, access restrictions, retention limits, deletion controls, or a review of whether storage is necessary. Duplicate checking reduces redundant records but does not address confidentiality or lifecycle security. There is no evidence that the Skill intentionally poisons memory with attacker-controlled rules. The issue is therefore insecure handling of sensitive persisted data rather than Agent Memory Poisoning. ### Attack Path 1. The user supplies revenue records, accounting conventions, and customer-related details. 2. The S ...[truncated 1164 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit, informed opt-in before persisting any result. 2. Make persistence optional and disabled by default. 3. Store only the minimum non-identifying summary needed for future calibration. 4. Exclude customer names, exact transaction values, raw records, and payment schedules unless the user expressly requests retention. 5. Prefer coarse ranges or normalized trends over exact financial amounts. 6. Encrypt retained data at rest and restrict the namespace to this Skill and the relevant user. 7. Define retention periods and automatically delete expired records. 8. Provide commands or controls that let users inspect, correct, export, and delete stored information. 9. Prevent shared-memory workflows from reading this namespace unless separately authorized. 10. Document whether storage is local or remote and identify which principals can access it. 11. Apply redaction and sensitivity classification before every memory write. 12. Keep an audit log of consent, writes, reads, modifications, and deletions without duplicating the sensitive payload in the log.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger list includes broad everyday phrases such as “钱去哪了”, “where did the money go”, and “business suddenly slowed”, which can match ordinary conversation rather than an explicit tool invocation. That increases the chance of accidental activation in unrelated contexts, causing the agent to load business-analysis instructions and potentially solicit or process sensitive financial data without clear user intent.

Static analysis

No suspicious patterns detected.