T01 · Skill Instruction Hijacking
Error
- Location
memori_extension.py:348- Finding
Retrieved memory can replace trusted system instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
memori-extension
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly transparent about local memory storage and optional external API use, but its LLM interception can replace the original system instructions with retrieved memory content.
Review this before installing in any agent that relies on strong system instructions or tool-use policies. Keep ZHIPUAI_API_KEY unset unless you explicitly accept sending conversation text to Zhipu AI, use a sandbox or restricted environment, and avoid storing untrusted text in the Memori database until the interceptor preserves original system messages and treats retrieved memories as untrusted reference material.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:57- Finding
Third-party dependencies are installed without version or integrity pinning
- Content
View full analysis
- Remediation
View remediation
zhipuai== ``` 2. Generate a lock file that also pins all transitive dependencies. 3. Use hash verification, such as `pip install --require-hashes -r requirements.txt`. 4. Configure an approved package index or internal dependency mirror. 5. Run automated dependency vulnerability and provenance scanning in CI. 6. Review dependency updates before changing pinned versions. 7. Install dependencies in an isolated virtual environment or container under a non-privileged account. 8. Update both `SKILL.md` and `README.md` so their installation commands use the same reviewed lock file. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (7)
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
- Content
md ### External API Calls ⚠️ **Important**: If `ZHIPUAI_API_KEY` is set, this skill may send conversation text to Zhipu AI's servers for augmentation. **To disable external API calls**: - Simply don't set `ZHIPUAI_API_KEY`
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
The skill explicitly states that when ZHIPUAI_API_KEY is configured, conversation text including user messages, system prompts, and assistant responses may be sent to an external service. This is a real context-leakage risk because sensitive prompts, secrets, internal instructions, or user data could be exfiltrated to a third-party API during normal operation.
- Content
md ### External API Calls ⚠️ **Important**: If `ZHIPUAI_API_KEY` is set, this skill may send conversation text to Zhipu AI's servers for augmentation. **To disable external API calls**: - Simply don't set `ZHIPUAI_API_KEY`
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill advertises capabilities to read environment variables and perform local file read/write operations, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a transparency and least-privilege gap: an operator or platform may enable the skill without clearly understanding or constraining what resources it can access.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill can persistently append terms to a file path controlled by MEMORI_TECH_TERMS_FILE, but this write capability is not reflected in the skill description. Hidden persistent file modification is risky because operators may enable or invoke the skill assuming it is read-only or memory-only, leading to unintended local state changes or corruption of arbitrary writable files if configuration is unsafe.
- Content
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python return { "entities": self._extract_entities(response.choices[0].message.content), "summary": response.choices[0].message.content[:500], "timestamp": __import__('datetime').datetime.now().isoformat() } except Exception as e:
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The injected system prompt explicitly says "You are a professional technical assistant" and instructs the model in English, which can steer outputs toward English regardless of the user's preferred language. The file does not offer any locale choice or opt-in mechanism to preserve the user's language preference.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
Loading and maintaining a standalone term list from an arbitrary path adds local file access behavior beyond the core purpose of memory augmentation and LLM interception. While related to entity extraction heuristics, this configurable file-management capability is not clearly part of the manifest's stated scope.
- Content