Security audit
Security checks for vulnerabilities and agentic risk
This skill is not clearly malicious, but it asks for persistent local monitoring, broad Codex session scanning, shared cross-agent state, and clipboard/app handoff behavior that users should review carefully before installing.
Install only if you want always-on local conversation monitoring. Before enabling it, review or remove the AGENTS.md hook, heartbeat/cron/task-scheduler setup, full-history scan, clipboard handoff, and cross-agent registry features. Prefer dry-run/manual modes and confirm the exact project, session range, and target app before exporting or handing off recovery text.
This mismatch includes undocumented cross-agent registry, liveness markers, and cross-check behavior, which are materially different from simple memory orchestration. Hidden shared-state coordination can expose metadata across agents or projects and create privacy surprises even if no full conversation text is stored.
This mismatch includes undocumented cross-agent registry, liveness markers, and cross-check behavior, which are materially different from simple memory orchestration. Hidden shared-state coordination can expose metadata across agents or projects and create privacy surprises even if no full conversation text is stored.
This mismatch includes undocumented cross-agent registry, liveness markers, and cross-check behavior, which are materially different from simple memory orchestration. Hidden shared-state coordination can expose metadata across agents or projects and create privacy surprises even if no full conversation text is stored.
This mismatch includes undocumented cross-agent registry, liveness markers, and cross-check behavior, which are materially different from simple memory orchestration. Hidden shared-state coordination can expose metadata across agents or projects and create privacy surprises even if no full conversation text is stored.
This mismatch includes undocumented cross-agent registry, liveness markers, and cross-check behavior, which are materially different from simple memory orchestration. Hidden shared-state coordination can expose metadata across agents or projects and create privacy surprises even if no full conversation text is stored.
This mismatch includes undocumented cross-agent registry, liveness markers, and cross-check behavior, which are materially different from simple memory orchestration. Hidden shared-state coordination can expose metadata across agents or projects and create privacy surprises even if no full conversation text is stored.
This mismatch includes undocumented cross-agent registry, liveness markers, and cross-check behavior, which are materially different from simple memory orchestration. Hidden shared-state coordination can expose metadata across agents or projects and create privacy surprises even if no full conversation text is stored.
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
天运行 python3 <skill>/scripts/monitor_dialogs.py --days 14 --write-state，仅在状态变化时汇报（本机已有同名自动化）。
schtasks /create /tn "MemoryOrchestratorMonitor" /sc daily /st 09:30 /tr "python <skill路径>\scripts\monitor_dialogs.py --days 14 --write-state"），系统用户登录即开始。crontab -e 加 30 9 * * * python3 <skill-path>/scripts/monitor_dialogs.py --days 30 --write-state。python3 $CODEX_HOME/skills/memory-orchestrator/scripts/monitor_dialogs.py --all --write-state
# --all 关闭时间过滤全量扫历史，与 --days 互斥；结果写 state.json.index：last_full_scan / scanned_files / 每会话 over_warned
# 同一对话框提�
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
"不得丢失未决问题、关键数字与文件路径。完成后按 memory-orchestrator 规则做校验并保留长期记忆。\n"
f"交接信息（生成于 {ts}）：{src}"
)
return prompt
def main():
ap = argparse.ArgumentParser(description="生成 create_thread 提示词（恢复包承接）")
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
_fake_rollout(sessions, "00000000-0000-0000-0000-000000000001", 9) # over
_fake_rollout(sessions, "00000000-0000-0000-0000-000000000002", 6)
tmp_state = Path(d) / "state.json"
env = dict(os.environ, CODEX_MEMORY_STATE=str(tmp_state))
r1 = subprocess.run([PY, str(SCRIPTS / "monitor_dialogs.py"), "--all",
"--sessions-dir", str(sessions), "--write-state", "--json"],
capture_output=True, text=True, env=env, timeout=60)
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
fd, td = tempfile.mkstemp(suffix=".json")
os.close(fd)
try:
env = dict(os.environ, CODEX_MEMORY_STATE=td)
for _ in range(7):
_run_state(env, "bump", "active_project=pp", "thread_id=ta", "agent=claude")
for _ in range(7):
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
fd, td = tempfile.mkstemp(suffix=".json")
os.close(fd)
try:
env = dict(os.environ, CODEX_MEMORY_STATE=td)
for _ in range(7):
_run_state(env, "bump", "active_project=pp", "thread_id=ta", "agent=claude")
for _ in range(7):
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
def p_handoff_gateway():
with tempfile.TemporaryDirectory() as d:
env = dict(os.environ, CODEX_MEMORY_STATE=str(Path(d) / "state.json"))
r = subprocess.run([PY, str(SCRIPTS / "handoff_gateway.py"), "--agent", "cursor",
"--project", "demo", "--out-dir", str(Path(d) / "out"),
"--dry-run", "--json"], capture_output=True, text=True, env=env, timeout=60)
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
def _cp_env():
fd, cpdb = tempfile.mkstemp(suffix=".db")
os.close(fd)
env = dict(os.environ, CP_MEMORY_DB_PATH=cpdb)
return env, cpdb
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
if sys.platform != "darwin":
print(" (state 不可写降级测试跳过：非 macOS)")
return
env = dict(os.environ, CODEX_MEMORY_STATE="/System/Volumes/Data/_memory_orch_selftest_nowrite/state.json")
r = subprocess.run([PY, str(SCRIPTS / "state.py"), "bump", "active_project=fb", "thread_id=f1"],
capture_output=True, text=True, env=env, timeout=30)
assert r.returncode == 0, r.stderr[-800:]
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
if sys.platform != "darwin":
print(" (recovery 不可写降级测试跳过：非 macOS)")
return
env = dict(os.environ, RECOVERY_INDEX="/System/Volumes/Data/_memory_orch_selftest_nowrite/recovery-index.md")
r = subprocess.run([PY, str(SCRIPTS / "recovery.py"), "--add", "fb", "/tmp/fb.md"],
capture_output=True, text=True, env=env, timeout=30)
assert r.returncode == 0, r.stderr[-800:]
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
fd, td = tempfile.mkstemp(suffix=".json")
os.close(fd)
try:
env = dict(os.environ, CODEX_MEMORY_STATE=td, PYTHON=PY)
r = subprocess.run(["bash", str(SCRIPTS / "agent_hook.sh"), "active_project=hk", "thread_id=d1"],
check=True, capture_output=True, text=True, env=env)
out = json.loads(r.stdout)
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
fd, tf = tempfile.mkstemp(suffix=".md")
os.close(fd)
try:
env = dict(os.environ, RECOVERY_INDEX=tf)
subprocess.run([PY, str(SCRIPTS / "recovery.py"), "--add", "demo", "/tmp/demo.md"], check=True,
capture_output=True, env=env)
text = Path(tf).read_text(encoding="utf-8")
Line L45 states the platform display uses a Chinese name, and the surrounding file is entirely Chinese-language without any indication of user language choice or opt-in. This can indicate a language/locale policy issue because the skill presentation appears to force a specific language rather than offering alternatives.
The skill documents capabilities that touch environment variables, local files, shell commands, scheduling, and possible network-adjacent deep links, but it does not declare an explicit tool/permission scope. That creates a least-privilege failure: an agent or reviewer cannot easily constrain what the skill is allowed to do, increasing the chance of unintended filesystem access, shell execution, or external app invocation.
The display name and full operational description are written in Chinese, and the instructions and trigger terms are presented only in Chinese without an explicit opt-in or alternative locale. This can amount to a language/locale policy violation because the skill implicitly forces a specific language for use.
Broad trigger phrases such as '总结/压缩/恢复/交接/开新对话/checkpoint' are likely to occur in normal conversation, causing accidental activation of file processing, state updates, or handoff flows. When a skill can write files, invoke shell commands, or prepare cross-app transfers, ambiguous triggers materially increase the chance of unintended sensitive operations.
The skill recommends persistence mechanisms such as cron, scheduled tasks, heartbeat automation, and AGENTS.md startup hooks so it can continue scanning sessions and updating state automatically. Persistent background execution increases blast radius if the skill is misconfigured or abused, and it can continuously access session logs and metadata beyond a single interactive request.
python3 <skill>/scripts/monitor_dialogs.py --days 14 --write-state，仅在状态变化时汇报（本机已有同名自动化）。schtasks /create /tn "MemoryOrchestratorMonitor" /sc daily /st 09:30 /tr "python <skill路径>\scripts\monitor_dialogs.py --days 14 --write-state"），系统用户登录即开始。crontab -e 加 30 9 * * * python3 <skill-path>/scripts/monitor_dialogs.py --days 30 --write-state。The skill includes behavior to create or open new threads in external agent apps and write audit logs about those jumps, even though the manifest frames it as local memory orchestration. Crossing application boundaries can leak sensitive recovery text, project identifiers, or thread metadata into other apps without sufficiently clear user intent or review.
Clipboard injection, deep-link generation with embedded text, and app launching are high-risk automation primitives because they can move sensitive context across trust boundaries and trigger actions in other software. In a memory-management skill, these behaviors are more dangerous because the data being handled is likely to be conversation history, decisions, and project context.
No suspicious patterns detected.