多Agent记忆系统

• Outcome: Review
• Latest audit: May 29, 2026 · 9:40 PM UTC
• Version: 1.0.0

Overview

This memory skill is mostly purpose-aligned, but it needs review because it persistently records prompts, tool activity, errors, and optional API keys with weak disclosure and storage controls.

Install only if you intentionally want persistent local memory capture. Use a private MEMORY_WORKSPACE outside /tmp, avoid putting secrets in prompts or tool summaries, leave API keys in environment or a secret manager rather than the setup config, and review retention/redaction controls before using this in shared or production environments.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

continue
            
            try:
                result = subprocess.run(
                    [sys.executable, str(script_path)],
                    capture_output=True,
                    text=True,

• Confidence: 87% confidence
• Finding: result = subprocess.run( [sys.executable, str(script_path)], capture_output=True, text=True, timeout=300

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises and invokes capabilities equivalent to shell execution, environment-variable access, and filesystem read/write, but does not declare any permissions or trust boundaries. That undermines user consent and review, and in a memory-oriented skill increases the chance that sensitive workspace data or secrets could be accessed or modified without explicit acknowledgement.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The documented purpose is a memory system, but the described behavior expands into agent lifecycle management, health checks, auto-scaling, setup/deployment flows, and subprocess-driven orchestration. This scope mismatch is dangerous because reviewers and users may approve a seemingly limited memory skill while actually granting a broader automation/orchestration tool control over local resources and other agents.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The page presents itself as a real-time health monitoring dashboard, but the JavaScript populates key metrics using Math.random() rather than actual telemetry. In an operations or monitoring context, fabricated health data can mislead users into trusting false system status, causing delayed incident response, poor decisions, or concealment of real failures.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README prominently advertises automatic capture, contradiction detection, token tracking, and multi-agent memory features, but provides no warning about the collection, storage, or possible exposure of conversation content and operational metadata. In a memory system for multiple agents, users may unknowingly enable broad retention of prompts, tool outputs, errors, and other potentially sensitive data, increasing privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README instructs users to configure an API key and external embedding/model settings but does not warn that requests may transmit memory contents or metadata to third-party services, nor does it describe secure secret handling. In a system that stores and retrieves agent memory, this can lead to inadvertent exfiltration of sensitive data or poor credential hygiene.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill prominently advertises automatic capture and long-term memory features but does not warn users what data may be collected, retained, indexed, or exposed through retrieval and dashboards. In a multi-agent context, automatic capture can aggregate prompts, outputs, files, and operational metadata across agents, increasing privacy and confidentiality risk.

Missing User Warnings

Low

• Confidence: 72% confidence
• Finding: Referencing an API key in environment configuration without explaining storage, use, masking, or logging expectations can lead to accidental disclosure through scripts, logs, dashboards, or test runs. While the markdown alone does not exfiltrate secrets, it signals secret consumption without sufficient operational safeguards.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code persistently stores user prompts, tool inputs/outputs, and error context to disk without consent, minimization, or retention controls. In an agent environment, these fields can easily contain secrets, personal data, internal file paths, or proprietary task content, creating a privacy and data exposure risk if the workspace is accessed by other users, tools, or later processes.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The feature is explicitly designed to automatically retain natural-language user and session content in persistent memory files. In a multi-agent skill, that materially increases the chance that sensitive prompts, operational details, or error traces are stored beyond the original interaction and later exposed through filesystem access or downstream processing.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The default configuration enables collection of user prompt summaries, inferred intent, tool input/output summaries, and error context, all of which are common carriers of credentials, personal data, or confidential workflow details. Because capture is enabled by default across multiple hook types, the exposure surface is broad and likely to affect routine use rather than edge cases.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: Captured data is appended to daily markdown files under a workspace path, creating an accumulating plaintext log of potentially sensitive interactions. This is dangerous because markdown logs are easy for users, agents, backup systems, and indexing tools to read, making secondary disclosure of captured content more likely.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The UserPrompt hook directly captures and stores prompt summaries and inferred intent, which are user-supplied and semantically sensitive by nature. In an agent skill, prompts often contain secrets, business context, personal information, or instructions about internal systems, so explicitly logging them creates a clear confidentiality risk.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.