AGI记忆模组

• Outcome: Review
• Latest audit: Aug 7, 2026 · 11:38 AM UTC
• Version: 1.0.13

Overview

This appears to be a real memory system, not malware, but it needs Review because it persistently profiles users and includes credential/key-management features beyond a normal memory helper.

Install only if you are comfortable with an always-on memory layer that may retain identity, emotional, behavioral, and preference inferences across sessions. Before use, require explicit opt-in, retention limits, viewing/deletion controls, and disable or isolate the credential manager unless secret storage is specifically intended.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (74)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill documents capabilities that imply file I/O, network/Redis access, shell-adjacent installation steps, credential handling, and persistent storage, yet it declares no explicit permissions boundary. In an always-on meta-skill, this creates hidden ambient authority: the host agent may invoke broad capabilities without clear user/admin review, increasing the chance of unauthorized data access, persistence, or exfiltration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The declared purpose presents the skill as a memory/context-engineering layer, but the documented behavior extends into credential management, encryption, audit logging, cross-session persistence, Redis infrastructure, monitoring, and security policy enforcement. This mismatch can mislead operators about the true trust boundary and data handling scope, causing the skill to be deployed in contexts where users did not expect persistent storage, cross-session correlation, or infrastructure access.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The schema includes explicit personality-style and psychological profiling fields such as neuroticism scoring, triggers, and derived evidence. For a memory-management skill, this exceeds what is needed for context retention and creates unnecessary collection of sensitive inferred traits that could be used to manipulate responses, discriminate, or silently profile users.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The emotional_memory schema stores emotion states, intensity, triggers, attitudes, and trends over time, enabling affective profiling rather than simple conversational memory. In a skill described as always-on and triggered by every interaction, this expands surveillance risk because sensitive emotional inferences can accumulate without clear necessity.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The narrative_memory schema tracks growth milestones, identity evolution, current identity, and continuous concerns, which supports longitudinal profiling well beyond ordinary memory retention. Combined with an always-on memory skill, this can build sensitive dossiers about a user’s self-concept and life trajectory, increasing privacy and misuse risk.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The API reference exposes credential-management and encryption functionality that materially exceeds the manifest's stated purpose of memory/context engineering. In a meta-skill that is described as always-on for all user-model interactions, undocumented sensitive-capability expansion increases the risk of collecting, storing, or transforming secrets without clear justification or user expectation.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Credential storage, retrieval, deletion, and key-management APIs are high-risk primitives for a skill whose declared role is memory/context orchestration rather than secret management. Because this skill is described as mandatory and persistent across all interactions, these capabilities could enable broad secret collection or retention far outside user expectations, making misuse especially dangerous.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: Direct Redis adapter and key-value storage capabilities provide generic persistence and retrieval beyond the narrowly described memory/context purpose. In an always-running meta-skill, this broad storage access can be used to persist arbitrary conversation-derived data, expand data collection scope, or bypass tighter abstractions that would otherwise limit misuse.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The document claims insight injection does not affect the main flow, yet separately specifies that high-fit signals are forcibly injected into context. In an always-on memory skill, forced contextual injection can steer model behavior, priorities, and tone without explicit user awareness, making this a real prompt-influence and transparency issue.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The document defines persistent user profiling, narrative tracking, semantic knowledge capture, emotional memory, and psychological-style inference far beyond minimal context retention. In a skill that is described as always-on and triggered by any user/model interaction, this creates broad privacy and surveillance risk because sensitive personal attributes can be inferred and retained across sessions without clear necessity or narrowing.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The 'neuroticism tendency' feature performs sensitive psychological profiling and then uses that inferred trait to alter decision weighting. This is dangerous because it infers mental-state characteristics from interaction data and operationalizes them in system behavior, creating serious privacy, manipulation, discrimination, and trust risks that are not justified by ordinary memory/context support.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Persistent tracking of emotional state, triggers, and satisfaction history captures sensitive affective data that is not clearly necessary for context engineering. Because the skill is designed to run on every interaction, this could continuously accumulate intimate behavioral data and enable profiling, targeting, or manipulative response shaping over time.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The package exports credential-management primitives from a skill whose declared purpose is memory/context engineering, creating a clear capability mismatch. In an always-on meta-skill that is triggered by all user-model interactions, exposing credential storage and management materially expands the attack surface and enables secret collection or persistence beyond user expectations.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Re-exporting CredentialRecord, CredentialStorage, CredentialManager, and create_credential_manager in __all__ makes credential handling a first-class public capability of the skill. For a persistent memory system that is described as forcibly resident and active on every interaction, this is especially dangerous because it normalizes secret retention inside a broad-scope component that can observe large volumes of sensitive data.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The LRUCache docstring explicitly claims thread safety, but the cache mutates shared OrderedDict state and accounting fields without any locking or synchronization. In a multi-threaded agent or service context, concurrent get/set/delete operations can cause race conditions, inconsistent cache state, incorrect eviction/accounting, and intermittent failures that may expose stale or unintended context data across requests.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The activation loop sums every activation source from all dimensions for every memory item, without checking whether a given source actually pertains to that memory. This can cause unrelated memories—including sensitive profile or emotional records—to be marked as relevant and injected into reconstructed context, creating over-broad data exposure and incorrect agent behavior. In a skill that runs on every user/model interaction and manages persistent memory, this is especially dangerous because the flaw systematically increases the chance of leaking or misusing unrelated personal context.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: This module’s documented behavior introduces credential-storage functionality that does not align with the declared always-on memory/context-engineering role of the skill. In an always-resident skill, scope mismatch is dangerous because it expands access to sensitive secrets beyond user expectations and creates an unnecessary path for secret handling inside a broadly triggered component.

Context-Inappropriate Capability

High

• Confidence: 93% confidence
• Finding: The code initializes, persists, and manages a master encryption key, adding a secret-management capability that is not justified by the stated purpose of the skill. Because this skill is described as always-on, embedding credential and key management in it increases the blast radius: any compromise, misuse, or unintended invocation could expose or manipulate stored secrets.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Exposing an API that returns the raw master key defeats the protection boundary of the encrypted credential store, because any caller with access to this method can decrypt all stored secrets. In the context of an always-on memory skill, this is especially risky because a broadly available internal API can be abused by other components or unintended execution paths to exfiltrate all credentials at once.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The recovery logic performs unsolicited outbound network probing to Google's public DNS server (8.8.8.8:53) to determine network availability. In a memory/context-engineering skill, this external connectivity capability is broader than necessary and can violate least-privilege, trigger unexpected egress, or conflict with restricted/offline environments.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The module explicitly infers emotional patterns and identity evolution from long-term memory and turns those inferences into actionable insights. In a memory/context-engineering skill, this is a privacy and scope-expansion issue because it creates sensitive user profiling that can influence later model behavior without clear necessity, consent, or controls.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The code generates recommendations such as when to perform tasks, when to avoid complex work, and how to adapt behavior based on inferred user state. That goes beyond neutral storage/retrieval and turns profiling into behavioral steering, which can manipulate or unduly influence users without transparency.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The module formats and injects synthesized 'smart insights' directly into downstream context, including preference/profile-derived recommendations. This is dangerous because hidden context injection can silently bias future model responses and operationalize inferred personal data without the user's awareness.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The memory-focused skill defines an EXECUTE_TOOL operation and marks it as a known, critical-capability action even though the module’s stated purpose is memory/context/state safety. In an always-on meta-skill, expanding the authorization surface to include unrelated tool execution increases the chance that downstream code will treat tool invocation as sanctioned by this manager, enabling privilege creep or unsafe coupling between memory actions and external tool use.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The confirmation flow stores only operation_id, operation, user_id, and created_at, but confirm_operation later accesses token_data["user_level"], which was never recorded. As a result, confirming a high-risk action can raise an exception or fail unpredictably, breaking the safety gate and audit path for destructive operations such as delete, restore, import, or execute_tool.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.privileged_always

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/encryption_guide.md:157

Skill is configured with always=true (persistent invocation).

Warn

• Code: suspicious.privileged_always
• Location: SKILL.md:1