Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed local memory manager, but it asks for persistent background monitoring of Codex session history and broad memory access that users should review carefully before installing.
Install only if you are comfortable with a skill reading Codex session metadata/history locally, writing persistent memory artifacts, and optionally running scheduled monitoring. Before enabling automation, restrict it to known project/session paths, require confirmation before exporting or compressing chat history, and add a clear way to disable the scheduled task and remove memory files.
The documented trigger phrases and claimed orchestration behavior can make the skill appear passive and conversational, while the body includes commands for scanning local session directories and metadata stores. That discrepancy can reduce informed consent and lead to broader-than-expected collection of sensitive chat history.
The documented trigger phrases and claimed orchestration behavior can make the skill appear passive and conversational, while the body includes commands for scanning local session directories and metadata stores. That discrepancy can reduce informed consent and lead to broader-than-expected collection of sensitive chat history.
The documented trigger phrases and claimed orchestration behavior can make the skill appear passive and conversational, while the body includes commands for scanning local session directories and metadata stores. That discrepancy can reduce informed consent and lead to broader-than-expected collection of sensitive chat history.
The documented trigger phrases and claimed orchestration behavior can make the skill appear passive and conversational, while the body includes commands for scanning local session directories and metadata stores. That discrepancy can reduce informed consent and lead to broader-than-expected collection of sensitive chat history.
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
天运行 `python3 <skill>/scripts/monitor_dialogs.py --days 14 --write-state`，仅在状态变化时汇报（本机已有同名自动化）。
- Windows：任务计划程序创建每日任务（`schtasks /create /tn "MemoryOrchestratorMonitor" /sc daily /st 09:30 /tr "python <skill路径>\scripts\monitor_dialogs.py --days 14 --write-state"`），系统用户登录即开始。
- Linux/WSL：`crontab -e` 加 `30 9 * * * python3 <skill-path>/scripts/monitor_dialogs.py --days 30 --write-state`。
- 无法注册系统定时任务的受限环境：把“打开新会话时运行一次 monitor_dialogs.py”写进该环境 AGENTS.md，作为降级触发。
- 本脚本不替代“当前对话框是否接近阈值”的会话内提醒；两者互补。
## Checkpoint（每 8 轮、里程碑或提前 1 轮提醒后）
1. 导出可压缩源（仅当前项目/会话，禁止默认扫全部日志）：先用 `state.py get` 确认 active_project，再用 `scripts/export_ctx.py` 指定该项�
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
fd, td = tempfile.mkstemp(suffix=".json")
os.close(fd)
try:
env = dict(os.environ, CODEX_MEMORY_STATE=td)
subprocess.run([PY, str(SCRIPTS / "state.py"), "set", "active_project=t", "turn_count=1"], check=True,
capture_output=True, env=env)
subprocess.run([PY, str(SCRIPTS / "state.py"), "bump", "active_project=t"], check=True, capture_output=True, env=env)
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
fd, tf = tempfile.mkstemp(suffix=".md")
os.close(fd)
try:
env = dict(os.environ, RECOVERY_INDEX=tf)
subprocess.run([PY, str(SCRIPTS / "recovery.py"), "--add", "demo", "/tmp/demo.md"], check=True,
capture_output=True, env=env)
text = Path(tf).read_text(encoding="utf-8")
The trigger list includes very common conversational words such as '总结', '恢复', and 'checkpoint', which can appear in ordinary discussion and may cause the skill to activate unintentionally. In this skill's context, accidental activation is more concerning because it can initiate memory retrieval, compression, or archival workflows touching local session history and persistent memory stores.
The skill explicitly instructs use of shell commands, environment variables, and file reads/writes against session logs, state files, and recovery artifacts, but it does not declare any tool scope such as permissions or allowed-tools. That creates a capability transparency gap: a reviewer or runtime may not realize the skill can access local files and invoke shell utilities, increasing the risk of overbroad execution and unintended data exposure.
The trigger phrases include very common words such as '总结', '压缩', '恢复', and 'checkpoint', which are likely to appear in normal conversation. Broad triggers can cause accidental activation of memory export/compression or archival workflows, leading to unintended reads of local chat logs or writes to persistent memory/state.
The instructions prescribe exact Chinese reminder text to output when thresholds are reached, which forces a specific language for user-facing interaction. The file does not indicate that this is optional, user-selected, or limited to a justified locale-specific deployment.
The skill recommends installing persistent scheduled execution via cron, Task Scheduler, or similar mechanisms so it runs automatically without user action. Persistent background execution that scans session directories and updates state expands the blast radius of any bug or misuse, and in a memory-oriented skill it can continuously process sensitive conversation artifacts beyond the immediate session.
- 安装后如何自动开始（按平台，不需用户每次手动跑）：
- macOS 桌面 Codex：在 Codex 里建 heartbeat/cron 自动化，每天运行 `python3 <skill>/scripts/monitor_dialogs.py --days 14 --write-state`，仅在状态变化时汇报（本机已有同名自动化）。
- Windows：任务计划程序创建每日任务（`schtasks /create /tn "MemoryOrchestratorMonitor" /sc daily /st 09:30 /tr "python <skill路径>\scripts\monitor_dialogs.py --days 14 --write-state"`），系统用户登录即开始。
- Linux/WSL：`crontab -e` 加 `30 9 * * * python3 <skill-path>/scripts/monitor_dialogs.py --days 30 --write-state`。
- 无法注册系统定时任务的受限环境：把“打开新会话时运行一次 monitor_dialogs.py”写进该环境 AGENTS.md，作为降级触发。
- 本脚本不替代“当前对话框是否接近阈值”的会话内提醒；两者互补。
The description is written entirely in Chinese, which signals a fixed language/locale expectation for the skill. The manifest does not indicate that language is selectable or that the skill is intentionally limited to a Chinese-speaking context, which can violate language/locale policy requirements.
The entire template and operational instructions are written in Chinese and prescribe Chinese output structure, but there is no indication that language selection is optional or limited to a justified region-specific use case. This can violate language/locale policy when used with users who have not opted into Chinese.
The trigger conditions are broad enough to cause the memory-orchestration behavior to activate on common conversational terms such as “总结” or “恢复,” and also on heuristic conditions like context becoming 'blurry.' That can lead to unintended summarization, archival, or cross-conversation state handling without a clear user request, increasing the risk of privacy leakage, incorrect context carryover, or disruptive workflow changes.
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
def save_state(d):
STATE.parent.mkdir(parents=True, exist_ok=True)
d["updated_at"] = time.strftime("%Y-%m-%d %H:%M")
STATE.write_text(json.dumps(d, ensure_ascii=False, indent=2), encoding="utf-8")
def _fmt(r):
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
args = ap.parse_args()
INDEX.parent.mkdir(parents=True, exist_ok=True)
if not INDEX.exists():
INDEX.write_text("# 恢复包索引\n\n| 项目 | 恢复包路径 | 登记时间 |\n|---|---|---|\n", encoding="utf-8")
if args.add:
project, path = args.add
lines = INDEX.read_text(encoding="utf-8").splitlines()
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
if path not in "".join(lines[2:]):
ts = time.strftime("%Y-%m-%d %H:%M")
line = f"| {project} | {path} | {ts} |"
INDEX.write_text("\n".join(lines + [line]) + "\n", encoding="utf-8")
print(f"added: {project} -> {path}")
else:
print("already indexed")
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
assert "ark-code-latest" in t and "200000" in t
def p_ctxcompress():
r = subprocess.run([str(CTX), "--version"], capture_output=True, text=True, timeout=30)
assert r.returncode == 0, r.stdout + r.stderr
assert "0.1.0" in (r.stdout + r.stderr)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
assert "0.1.0" in (r.stdout + r.stderr)
def p_monitor_dialogs():
r = subprocess.run([PY, str(SCRIPTS / "monitor_dialogs.py"), "--days", "14", "--json"],
capture_output=True, text=True, timeout=60)
assert r.returncode == 0, r.stderr[-800:]
data = json.loads(r.stdout)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
assert "scanned" in data and "over_sessions" in data and "warn_sessions" in data
def _mcp_lines(payloads):
p = subprocess.Popen([str(CPM)], stdin=subprocess.PIPE, stdout=subprocess.PIPE, bufsize=0)
out = []
initialized = False
for i, obj in enumerate(payloads, start=1):
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
src.write_text(json.dumps({"response_item": {"type": "message", "role": "user",
"content": [{"type": "text", "text": "你好"}]}}), encoding="utf-8")
out = Path(d) / "chat.json"
subprocess.run([PY, str(SCRIPTS / "export_ctx.py"), "-i", str(src), "-o", str(out)], check=True, capture_output=True)
data = json.loads(out.read_text(encoding="utf-8"))
assert data and data[0]["role"] == "user" and data[0]["content"] == "你好"
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
os.close(fd)
try:
env = dict(os.environ, CODEX_MEMORY_STATE=td)
subprocess.run([PY, str(SCRIPTS / "state.py"), "set", "active_project=t", "turn_count=1"], check=True,
capture_output=True, env=env)
subprocess.run([PY, str(SCRIPTS / "state.py"), "bump", "active_project=t"], check=True, capture_output=True, env=env)
r = subprocess.run([PY, str(SCRIPTS / "state.py"), "get"], check=True, capture_output=True, env=env)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
env = dict(os.environ, CODEX_MEMORY_STATE=td)
subprocess.run([PY, str(SCRIPTS / "state.py"), "set", "active_project=t", "turn_count=1"], check=True,
capture_output=True, env=env)
subprocess.run([PY, str(SCRIPTS / "state.py"), "bump", "active_project=t"], check=True, capture_output=True, env=env)
r = subprocess.run([PY, str(SCRIPTS / "state.py"), "get"], check=True, capture_output=True, env=env)
d = json.loads(r.stdout)
assert d["active_project"] == "t" and d["turn_count"] == 2, d
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
subprocess.run([PY, str(SCRIPTS / "state.py"), "set", "active_project=t", "turn_count=1"], check=True,
capture_output=True, env=env)
subprocess.run([PY, str(SCRIPTS / "state.py"), "bump", "active_project=t"], check=True, capture_output=True, env=env)
r = subprocess.run([PY, str(SCRIPTS / "state.py"), "get"], check=True, capture_output=True, env=env)
d = json.loads(r.stdout)
assert d["active_project"] == "t" and d["turn_count"] == 2, d
finally:
No suspicious patterns detected.