Memory Sorting

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:59 AM UTC
• Version: 3.0.7

Overview

This skill does what it says, but it asks to read and modify broad persistent memory files with limited safeguards.

Install only if you are comfortable letting the agent inspect your full memory store and propose edits or deletions. Review proposed changes carefully, especially deletions, and consider making backups before approving execution.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:39

Finding

Overly Broad Read, Search, and Modification Access to Persistent Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:39-60, with supporting permission and modification instructions at SKILL.md:163-168 and SKILL.md:176-180
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Complete Relevant Snippet

The following is an English translation of the relevant instructions in SKILL.md:

markdown

## Step 1 — Systematic Scan [Checklist Gate]

A complete scan of the following three parts is mandatory. No steps may be skipped.

**1.1 Scan the topics/ directory**

For every `.md` file:
1. Read the frontmatter and extract `name`, `description`, `type`, and `mtime`
2. Read the complete file contents for content comparison
3. Record: `{ filename, type, mtime, content, description }`

**1.2 Scan MEMORY.md**

1. Count lines and bytes
2. Parse every pointer and extract `topics/xxx.md` paths
3. Identify orphaned files: files present in topics/ but not indexed by MEMORY.md

**1.3 Scan daily journals as timeline references**

Scan `memory/*.md` and extract the latest conclusions to determine whether topic
contents are obsolete.

markdown

**Authenticity validation:**

Memories that reference specific files or paths must verify that the files still
exist. If a file does not exist, propose deleting that memory. If a statement
conflicts with current code or configuration, trust the current state and update
or delete the obsolete memory.

markdown

## Permission Requirements

- `FileRead`: Read all memory files
- `FileWrite` / `FileEdit`: Modify topics/, MEMORY.md, and daily files
- `exec`: Perform global grep searches for duplicate and conflict detection

Technical Analysis

The Skill requests systematic access to the complete persistent memory repository, including topic files, the central memory index, and daily journals. It also requests write and edit permissions over those records and comma ...[truncated 3492 chars]

Remediation

View remediation

Remediation Suggestions

1. Constrain the filesystem scope

   • Resolve a configured memory root to its canonical path before every operation.
   • Permit access only to MEMORY.md, topics/*.md, and explicitly configured daily journal files beneath that root.
   • Reject absolute paths, .. traversal, symbolic links, and any resolved path outside the approved root.

2. Replace unrestricted command execution

   • Use bounded native file-search functionality instead of general-purpose exec.
   • If grep is unavoidable, construct arguments internally without shell interpolation, pass paths as separate arguments, include --, and provide only allowlisted canonical paths.
   • Do not describe the operation as a “global” search.

3. Reduce sensitive-data exposure

   • Process comparisons locally where possible rather than reproducing complete files in model output.
   • Detect and redact credentials, tokens, private keys, personal information, and other secrets before including excerpts in proposals or reports.
   • Display only the minimum relevant excerpts needed to explain each finding.

4. Strengthen modification approval

   • Produce an exact per-file diff before any write or deletion.
   • Require explicit approval for each destructive operation, especially daily-journal modification or deletion.
   • Treat general approval as insufficient for files containing detected secrets or high-sensitivity data.

5. Provide recovery controls

   • Create timestamped backups before modifying persistent memory.
   • Use atomic writes and verify both syntax and readability after each change.
   • Provide a rollback command and retain the backup until the user confirms the result.

6. Limit deletion heuristics

   • Do not delete a memory merely because a referenced path is absent.
   • Distinguish between invalid claims, intentionally historical records, temporarily unavailable paths, and references ...[truncated 407 chars]

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description, trigger phrases, workflow instructions, and approval commands are all written in Chinese, which effectively forces a specific language for use of the skill. There is no indication that users may choose another language, nor any documented regional justification for the restriction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.