一套优雅的模块化智能记忆系统，支持 embeddings、reranker 和 Flomo 笔记集成。

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:38 AM UTC
• Version: 0.1.0

Overview

This memory/search skill is purpose-aligned, but it ships a hard-coded API credential and sends memory content to an external embedding/reranking service by default without enough disclosure.

Review this carefully before installing. Do not use it with private notes, secrets, business records, or existing memory stores unless you are comfortable sending that content to the configured Edgefn endpoint. The included API key should be treated as exposed and replaced with your own secret from a safe source; the publisher should rotate it and remove it from distributed artifacts. Prefer disabling automatic embedding/reranking or using a local provider until the skill adds clear privacy disclosure, explicit opt-in, and safer import path limits.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: config/template.json:5

Finding

Hardcoded Edgefn API Credential Distributed with the Project

Content

View full analysis

`. 4. If the credential remains active, the attacker consumes quota or performs operations under the associated account. 5. Abuse may continue until the credential is revoked, regardless of whether it is removed from the latest source revision. ### Impact Assessment If active, the credential may permit unauthorized use of the associated Edgefn account, including quota consumption, financial cost, service disruption, rate-limit exhaust ...[truncated 216 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/services/MemoryService.js:91

Finding

Private Memory Content Is Automatically Transmitted to an External Service

Content

View full analysis

r.memory.content); const rerankResults = await this.config.rerankProvider.rerank(query, documents); ``` The embedding request contains the complete input text: ```javascript const requestData = { model: this.config.model, input: texts, dimensions: this.config.dimensions }; ``` The reranking request contains the complete query and candidate documents: ```javascript const requestData = { model: this.config.model, query: query, documents: ...[truncated 3357 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: src/adapters/FlomoAdapter.js:365

Finding

Flomo Import Command Performs an Unrestricted Synchronous Local-File Read

Content

View full analysis

[--batchSize=10]' }; } try { const flomoAdapter = this.memoryCore.createFlomoAdapter({ verbose: true }); const parseResult = await flomoAdapter.parseFromFile(filePath); ``` The adapter synchronously reads the entire selected file: ```javascript async parseFromFile(filePath, options = {}) { try { this.log(`📄 Reading Flomo export from: ${filePath}`); const htmlContent = fs.readFileSync(filePath, 'utf8'); return await this.parseExport(htmlContent, options); } catch (error) { ``` The parser currently contains a separate reliability defect because the `JSDOM` import is commented out while the symbol is still used: ```javascript // const { JSDOM } = require('jsdom'); ``` ```javascript const dom = new JSDOM(htmlContent); ``` ### Technical Analysis The import handler passes an untrusted path directly to `fs.readFileSync`. It does not: - Restrict the path to an approved import directory - Canonicalize the path before authorization - Prevent `..` traversal - Detect symbolic-link escapes - Require a regular file - Enforce an expected extension or file format - Apply a maximum file size - Use bounded asynchronous or streaming input The read occurs synchronously and loads the entire file into memory. A caller capable of invoking the im ...[truncated 2049 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (127)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file appears to force a specific language for all users through its headings and instructions. Under the policy, language restrictions should either provide user choice or clearly justify the locale requirement, neither of which is present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises API-key-based integrations and multi-platform embeddings/reranker support, but does not tell users that their queries or imported content may be transmitted to external providers for processing. Because this skill is specifically designed for semantic memory and reranking, the missing disclosure increases the risk of unintentional exfiltration of private notes, prompts, or other sensitive content to third parties.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation explicitly promotes adding memories and importing Flomo notes, which are likely to contain personal or sensitive information, but provides no warning about privacy risks, retention, or downstream processing. In a memory/search skill, this omission can cause users to ingest sensitive notes into a system that may store, index, or transmit them to third-party services without informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 99% confidence

Finding

The configuration contains a hard-coded API key alongside an external service endpoint, which creates a real secret exposure risk and enables unauthorized use of the external API if the file is disclosed. The skill context increases the danger because this component automatically performs embedding/reranking and may transmit user memory content to a third-party service, raising both credential abuse and data exfiltration concerns.

Content

Scanner excerpt · config/template.json (reported line 6)May include surrounding context.

json

"verbose": true,
    
    "apiKey": "sk-BrwHc1ZiaEGQ1GecD3D760384b874795A194882c2cF3AbE6",
    "baseUrl": "https://api.edgefn.net/v1",
    
    "embeddingProvider": {
      "type": "edgefn",

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The value "未分类" forces a Chinese default category label in configuration, which is a natural-language locale choice. The file does not offer a language/locale option or document that the skill is intentionally region-specific, so this appears to violate the language/locale policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file presents user-facing description, command descriptions, usage text, and configuration descriptions in Chinese only. This creates a natural-language locale constraint without any opt-in, language selection mechanism, or stated region-specific justification, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file describes integration with external embeddings/reranker providers and Flomo import functionality, which can transmit user note content to third-party services and ingest external data into the memory system. The README presents these capabilities as features and quick-start usage but does not include any warning about privacy, external processing, or reviewing imported content before use.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file is presented as a README, but it contains trailing shell commands that execute output, change directories, and run a test script. Documentation files are often trusted and copied verbatim by users or tooling, so mixing executable commands into a README increases the risk of unintended command execution and can be abused for supply-chain style social engineering.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This JavaScript example reads a sensitive credential from process.env.EDGEFN_API_KEY, but the file provides no warning or explanatory comment about handling credentials. Although the script logs general progress, it does not disclose that execution depends on and consumes a secret from the user's environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This JavaScript file contains developer comments and console output such as 'Memory Core 主入口' and '快速启动' only in Chinese. Under the policy rule, forcing a specific language without opt-in is a natural-language policy violation when no alternative language option or justification is provided.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module-level documentation states this adapter parses Flomo export files and imports them into MemoryService. However, the required JSDOM import is commented out, and parseExport still calls new JSDOM(htmlContent), which will fail at runtime instead of performing the documented parsing behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The adapter claims to parse supplied Flomo HTML export content, but it ignores the input entirely and returns hard-coded sample notes. In a memory-import workflow, this can silently corrupt data integrity, mislead downstream automation, and cause users or agents to believe an import succeeded when no real content was processed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code reads EDGEFN_API_KEY from environment variables and configures external Edgefn endpoints, which implies credential handling and network transmission to a third-party service. While internal debug logging exists elsewhere, there is no user-facing warning, comment, or explanatory docstring here disclosing that credentials are consumed and requests will be sent to a remote API.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code sends the provided texts to a remote HTTPS endpoint and includes a bearer token from configuration/environment variables. While the network call is core to an embeddings provider, this file contains no user-facing disclosure, prompt, or comment warning that user content will be transmitted to an external service and that credentials are used for the request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This method sends the provided query and full documents payload to a remote HTTPS endpoint, which may include user or system data. The file contains no confirmation prompt and no clear user-facing warning in comments or docstrings that this data is transmitted off-box.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code sends the supplied texts to provider.generateEmbeddings(...), which is a likely network/provider call involving user content. Although there is a verbose log message, it does not disclose to the user that their text may be sent to an external embedding provider, and the file contains no comment or docstring warning about that data transmission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The add() path sends raw memory content to this.config.embeddingService.embed([content]), which may transmit user data to an external service. Although failures are logged, there is no confirmation prompt, explicit disclosure comment/docstring, or other user-facing warning near this operation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The search flow submits the user's query to embeddingService.embed([query]) and may also send the query plus memory documents to rerankProvider.rerank(query, documents). These are network-capable operations involving potentially sensitive user/system data, but this file provides no visible warning, prompt, or explanatory comment for users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

When updates.content is provided, the service regenerates embeddings by sending the updated content to the embedding service. This repeats the same data-transmission risk as initial add(), but there is no nearby disclosure or confirmation that updated memory text may leave the local system.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code file contains natural-language documentation entirely in Chinese, including the title and operational descriptions, with no indication that language choice is configurable or that the skill is region-specific. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script labels itself as a real API test in its runtime output, but the configuration uses a nonfunctional placeholder credential (sk-your-api-key-here). This is not merely incomplete documentation: the file's stated intent to exercise a real API is contradicted by the embedded test configuration, which will not perform a genuine authenticated test unless manually changed.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · memory-core/README.md (reported line 75)May include surrounding context.

md

const CONFIG = {
  verbose: true,
  apiKey: 'sk-your-api-key-here',
  baseUrl: 'https://api.edgefn.net/v1',
  embeddingProvider: {
    type: 'edgefn',
    model: 'BAAI/bge-m3',

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · memory-core/config/template.json (reported line 6)May include surrounding context.

json

const CONFIG = {
  verbose: true,
  apiKey: 'sk-your-api-key-here',
  baseUrl: 'https://api.edgefn.net/v1',
  embeddingProvider: {
    type: 'edgefn',
    model: 'BAAI/bge-m3',

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · memory-core/src/managers/ServiceContainer.js (reported line 20)May include surrounding context.

js

const CONFIG = {
  verbose: true,
  apiKey: 'sk-your-api-key-here',
  baseUrl: 'https://api.edgefn.net/v1',
  embeddingProvider: {
    type: 'edgefn',
    model: 'BAAI/bge-m3',

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · memory-core/src/managers/ServiceContainer.js (reported line 27)May include surrounding context.

js

const CONFIG = {
  verbose: true,
  apiKey: 'sk-your-api-key-here',
  baseUrl: 'https://api.edgefn.net/v1',
  embeddingProvider: {
    type: 'edgefn',
    model: 'BAAI/bge-m3',

Static analysis

No suspicious patterns detected.