T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:2- Finding
Mandatory Always-On Activation Grants Continuous Access to Agent Interactions
- Content
View full analysis
- Remediation
View remediation
Security audit
AGI记忆模组
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed memory-system skill, but it runs on every interaction and can persist conversation data without strong enforced consent or secure storage defaults.
Review this before installing. It is not evidence of malware, but installing it means a memory layer may participate in every conversation and may store conversation-derived data. Only use it where users explicitly agree to memory, Redis is locked down with authentication, TLS, and encryption, credential storage is isolated, and retention/deletion controls are clear.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/context_orchestrator.py:2505- Finding
Unified Memory Storage API Does Not Enforce Required User Consent
- Content
View full analysis
str: """ 存储到短期记忆（便捷方法） Args: content: 内容 bucket_type: 语义桶类型 topic_label: 话题标签 relevance_score: 相关性分数 Returns: 记忆项 ID """ return self._short_term.store( content=content, bucket_type=bucket_type, topic_label=topic_label, relevance_score=relevance_score, ) ``` ### Technical Analysis The project documentation states that privacy consent is required before user data is processed or stored. However, the recommended unified entry point exposes `store_memory()` without accepting a consent object, consulting a consent manager, or verifying that the relevant user has granted memory-storage permission. The method directly forwards arbitrary content to the short-term storage subsystem. Consequently, privacy protection depends entirely on every caller voluntarily performing a separate consent workflow. This is a fail-open design: accidental, outdated, or malicious integrations can bypass the documented privacy boundary. Authorization and consent checks must be enforced at the sensitive operation itself. Documentation alone is not an effective security control. ### Attack Path 1. An integration creates or receives a `ContextOrchestrator` instance. 2. The integration does not initialize `PrivacyManager`, or it ignores a pending or denied consent state. 3. It calls `store_memory()` with user conversation content. 4. `store_memory()` performs no consent or authorization check. 5. The content is forwarded directly to `ShortTermMemoryRedis.store()`. 6. Depending on configuration, the cont ...[truncated 607 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/redis_adapter.py:101- Finding
Redis Memory Transport and Storage Are Insecure by Default
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/credential_manager.py:153- Finding
Credential Master Key Is Stored as Plaintext-Equivalent Base64 and Exposed Through a Public Export API
- Content
View full analysis
str: """ 导出主密钥（用于备份或迁移） Returns: Base64 编码的主密钥 """ return base64.b64encode(self._master_key).decode("utf-8") ``` ### Technical Analysis Base64 is an encoding and provides no confidentiality. The automatically generated credential master key is written directly into the credential storage directory in a reversible form. File mode `0600` limits access to the file owner, but it does not protect against: - compromise of the process account; - directory backups or snapshots; - accidental file copying; - privileged local readers; - vulnerabilities that provide arbitrary file read under the same account. The public `export_master_key()` method also returns the complete key without an authorization check, reauthentication step, audit record, or protected output channel. In an agent environment, a returned secret may be included in tool output, logs, or model-visible context. No evidence was found that this method automatically transmits the key over a network. The risk is direct disclosure to any caller that can invoke the API. ### Attack Path 1. The credential manager generates a master key. 2. It stores that key as a Base64 string in `MASTER_KEY_FILE`. 3. Credentials are encrypted using the sam ...[truncated 814 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:5- Finding
Dependency Manifest Is Mutable and Does Not Support Its Advertised Hash Verification
- Content
View full analysis
=2.0.0,<3.0.0 pydantic-settings>=2.0.0,<3.0.0 typing-extensions>=4.0.0 cryptography>=41.0.0,<45.0.0 redis>=4.5.0,<6.0.0 tiktoken>=0.5.0,<1.0.0 mmh3>=3.0.0,<5.0.0 numpy>=1.24.0,<2.0.0 orjson>=3.9.0,<4.0.0 python-dateutil>=2.8.0,<3.0.0 ``` ```bash pip install pydantic>=2.0.0 typing-extensions>=4.0.0 cryptography>=41.0.0 redis>=4.5.0 tiktoken>=0.5.0 mmh3>=3.0.0 ``` ### Technical Analysis The dependency manifest uses broad version ranges and contains no package hashes. Consequently, installations performed at different times may resolve to different package versions. The file claims that `pip install --require-hashes` can be used, but hash-checking mode requires pinned requirements and hashes for all resolved packages. The provided manifest does not satisfy those requirements. The audit did not identify a confirmed malicious or typosquatted package. The vulnerability is the lack of reproducibility and artifact verification, which enlarges the supply-chain attack surface. ### Attack Path 1. An operator installs the Skill using the documented `pip install` command or the range-based requirements file. 2. The package index resolves the newest versions allowed by the ranges. 3. A future compromised, vulnerable, or behaviorally incompatible release falls within an allowed range. 4. The installer downloads that release without verifying an expected artifact hash. 5. Package installation or later import executes code from the newly resolved artifact in the Skill's environment. Successful exploitation requires compromise or abuse of an allowed upstream package, package-index account, distribution path, or resolver sou ...[truncated 436 chars]- Remediation
View remediation
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (328)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description presents the package as an always-on meta-skill triggered on every interaction, while the documented capabilities extend into persistence, encryption, credential storage, privacy/audit, logging, monitoring, and Redis connectivity. This mismatch is security-relevant because operators may approve the skill as a benign context helper while it actually enables much broader data collection, retention, and infrastructure interaction than the description clearly discloses.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description presents the package as an always-on meta-skill triggered on every interaction, while the documented capabilities extend into persistence, encryption, credential storage, privacy/audit, logging, monitoring, and Redis connectivity. This mismatch is security-relevant because operators may approve the skill as a benign context helper while it actually enables much broader data collection, retention, and infrastructure interaction than the description clearly discloses.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description presents the package as an always-on meta-skill triggered on every interaction, while the documented capabilities extend into persistence, encryption, credential storage, privacy/audit, logging, monitoring, and Redis connectivity. This mismatch is security-relevant because operators may approve the skill as a benign context helper while it actually enables much broader data collection, retention, and infrastructure interaction than the description clearly discloses.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description presents the package as an always-on meta-skill triggered on every interaction, while the documented capabilities extend into persistence, encryption, credential storage, privacy/audit, logging, monitoring, and Redis connectivity. This mismatch is security-relevant because operators may approve the skill as a benign context helper while it actually enables much broader data collection, retention, and infrastructure interaction than the description clearly discloses.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description presents the package as an always-on meta-skill triggered on every interaction, while the documented capabilities extend into persistence, encryption, credential storage, privacy/audit, logging, monitoring, and Redis connectivity. This mismatch is security-relevant because operators may approve the skill as a benign context helper while it actually enables much broader data collection, retention, and infrastructure interaction than the description clearly discloses.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description presents the package as an always-on meta-skill triggered on every interaction, while the documented capabilities extend into persistence, encryption, credential storage, privacy/audit, logging, monitoring, and Redis connectivity. This mismatch is security-relevant because operators may approve the skill as a benign context helper while it actually enables much broader data collection, retention, and infrastructure interaction than the description clearly discloses.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description presents the package as an always-on meta-skill triggered on every interaction, while the documented capabilities extend into persistence, encryption, credential storage, privacy/audit, logging, monitoring, and Redis connectivity. This mismatch is security-relevant because operators may approve the skill as a benign context helper while it actually enables much broader data collection, retention, and infrastructure interaction than the description clearly discloses.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description presents the package as an always-on meta-skill triggered on every interaction, while the documented capabilities extend into persistence, encryption, credential storage, privacy/audit, logging, monitoring, and Redis connectivity. This mismatch is security-relevant because operators may approve the skill as a benign context helper while it actually enables much broader data collection, retention, and infrastructure interaction than the description clearly discloses.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description presents the package as an always-on meta-skill triggered on every interaction, while the documented capabilities extend into persistence, encryption, credential storage, privacy/audit, logging, monitoring, and Redis connectivity. This mismatch is security-relevant because operators may approve the skill as a benign context helper while it actually enables much broader data collection, retention, and infrastructure interaction than the description clearly discloses.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description presents the package as an always-on meta-skill triggered on every interaction, while the documented capabilities extend into persistence, encryption, credential storage, privacy/audit, logging, monitoring, and Redis connectivity. This mismatch is security-relevant because operators may approve the skill as a benign context helper while it actually enables much broader data collection, retention, and infrastructure interaction than the description clearly discloses.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description presents the package as an always-on meta-skill triggered on every interaction, while the documented capabilities extend into persistence, encryption, credential storage, privacy/audit, logging, monitoring, and Redis connectivity. This mismatch is security-relevant because operators may approve the skill as a benign context helper while it actually enables much broader data collection, retention, and infrastructure interaction than the description clearly discloses.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description presents the package as an always-on meta-skill triggered on every interaction, while the documented capabilities extend into persistence, encryption, credential storage, privacy/audit, logging, monitoring, and Redis connectivity. This mismatch is security-relevant because operators may approve the skill as a benign context helper while it actually enables much broader data collection, retention, and infrastructure interaction than the description clearly discloses.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description presents the package as an always-on meta-skill triggered on every interaction, while the documented capabilities extend into persistence, encryption, credential storage, privacy/audit, logging, monitoring, and Redis connectivity. This mismatch is security-relevant because operators may approve the skill as a benign context helper while it actually enables much broader data collection, retention, and infrastructure interaction than the description clearly discloses.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description presents the package as an always-on meta-skill triggered on every interaction, while the documented capabilities extend into persistence, encryption, credential storage, privacy/audit, logging, monitoring, and Redis connectivity. This mismatch is security-relevant because operators may approve the skill as a benign context helper while it actually enables much broader data collection, retention, and infrastructure interaction than the description clearly discloses.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description presents the package as an always-on meta-skill triggered on every interaction, while the documented capabilities extend into persistence, encryption, credential storage, privacy/audit, logging, monitoring, and Redis connectivity. This mismatch is security-relevant because operators may approve the skill as a benign context helper while it actually enables much broader data collection, retention, and infrastructure interaction than the description clearly discloses.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description presents the package as an always-on meta-skill triggered on every interaction, while the documented capabilities extend into persistence, encryption, credential storage, privacy/audit, logging, monitoring, and Redis connectivity. This mismatch is security-relevant because operators may approve the skill as a benign context helper while it actually enables much broader data collection, retention, and infrastructure interaction than the description clearly discloses.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description presents the package as an always-on meta-skill triggered on every interaction, while the documented capabilities extend into persistence, encryption, credential storage, privacy/audit, logging, monitoring, and Redis connectivity. This mismatch is security-relevant because operators may approve the skill as a benign context helper while it actually enables much broader data collection, retention, and infrastructure interaction than the description clearly discloses.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description presents the package as an always-on meta-skill triggered on every interaction, while the documented capabilities extend into persistence, encryption, credential storage, privacy/audit, logging, monitoring, and Redis connectivity. This mismatch is security-relevant because operators may approve the skill as a benign context helper while it actually enables much broader data collection, retention, and infrastructure interaction than the description clearly discloses.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description presents the package as an always-on meta-skill triggered on every interaction, while the documented capabilities extend into persistence, encryption, credential storage, privacy/audit, logging, monitoring, and Redis connectivity. This mismatch is security-relevant because operators may approve the skill as a benign context helper while it actually enables much broader data collection, retention, and infrastructure interaction than the description clearly discloses.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description presents the package as an always-on meta-skill triggered on every interaction, while the documented capabilities extend into persistence, encryption, credential storage, privacy/audit, logging, monitoring, and Redis connectivity. This mismatch is security-relevant because operators may approve the skill as a benign context helper while it actually enables much broader data collection, retention, and infrastructure interaction than the description clearly discloses.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description presents the package as an always-on meta-skill triggered on every interaction, while the documented capabilities extend into persistence, encryption, credential storage, privacy/audit, logging, monitoring, and Redis connectivity. This mismatch is security-relevant because operators may approve the skill as a benign context helper while it actually enables much broader data collection, retention, and infrastructure interaction than the description clearly discloses.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description presents the package as an always-on meta-skill triggered on every interaction, while the documented capabilities extend into persistence, encryption, credential storage, privacy/audit, logging, monitoring, and Redis connectivity. This mismatch is security-relevant because operators may approve the skill as a benign context helper while it actually enables much broader data collection, retention, and infrastructure interaction than the description clearly discloses.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description presents the package as an always-on meta-skill triggered on every interaction, while the documented capabilities extend into persistence, encryption, credential storage, privacy/audit, logging, monitoring, and Redis connectivity. This mismatch is security-relevant because operators may approve the skill as a benign context helper while it actually enables much broader data collection, retention, and infrastructure interaction than the description clearly discloses.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description presents the package as an always-on meta-skill triggered on every interaction, while the documented capabilities extend into persistence, encryption, credential storage, privacy/audit, logging, monitoring, and Redis connectivity. This mismatch is security-relevant because operators may approve the skill as a benign context helper while it actually enables much broader data collection, retention, and infrastructure interaction than the description clearly discloses.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The description presents the package as an always-on meta-skill triggered on every interaction, while the documented capabilities extend into persistence, encryption, credential storage, privacy/audit, logging, monitoring, and Redis connectivity. This mismatch is security-relevant because operators may approve the skill as a benign context helper while it actually enables much broader data collection, retention, and infrastructure interaction than the description clearly discloses.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal, suspicious.privileged_always
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- references/encryption_guide.md:157
Skill is configured with always=true (persistent invocation).
Warn
- Code
- suspicious.privileged_always
- Location
- SKILL.md:1