Memory Recall

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:57 AM UTC
• Version: 1.0.0

Overview

This skill is a memory-search helper, but it broadly searches persistent memory files without clear user, workspace, or sensitivity limits.

Install only in environments where memory files are already access-controlled per user or workspace. Avoid enabling it for shared agents unless retrieval is bounded, sensitive results are redacted, and broad searches require confirmation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:40

Finding

Unrestricted Retrieval of Potentially Sensitive Persistent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 40-57
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Relevant Code Snippet:

text

用户查询
  ├── 解析：用户想找什么？
  ├── 搜索：MEMORY.md（精确） + memory/*.md（日记）
  ├── 过滤：按日期/关键词/类型
  ├── 排序：最新最相关优先
  └── 呈现：来源 + 内容 + 时间

markdown

| 查询类型 | 优先搜索 |
|---------|---------|
| 偏好类 | MEMORY.md |
| 决策类 | MEMORY.md + 最新日记 |
| 事件类 | memory/YYYY-MM-DD.md |
| 项目类 | MEMORY.md 项目章节 |
| 人物类 | MEMORY.md 联系人章节 |

Technical Analysis

The skill directs the agent to search persistent memory files, including MEMORY.md and date-based files under memory/. Its retrieval scope includes preferences, decisions, events, projects, people, and historical conversation fragments.

Although this access is consistent with the skill's stated memory-retrieval purpose, the instructions do not define authorization checks, user or workspace isolation, path restrictions, sensitive-data filtering, or confirmation requirements. Consequently, the retrieval workflow may expose information beyond what the requester is authorized to access when memory storage is shared or contains material from multiple users or contexts.

The issue is classified as unauthorized access because the skill assumes that any requester invoking it is entitled to search and receive all matching persistent-memory content. The reviewed file contains no network transmission, executable payload, persistence mechanism, dependency installation, or memory-writing behavior.

Attack Path

1. An attacker or unauthorized user gains the ability to interact with an agent that has this skill enabled.
2. The attacker submits a broad request, such as asking for all records concerning a person, project, date range, decision, or sensitive keyword.
3. Following the skill instructions, the agent searches MEMORY.md and matching files under memory/.
4. The agent fi ...[truncated 959 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit requester authorization before searching persistent memory.
2. Bind every memory record to a user, tenant, session, or workspace identifier and enforce this boundary before retrieval.
3. Restrict file access to an approved memory root and reject path traversal, arbitrary paths, and symbolic-link escapes.
4. Apply least-privilege retrieval by requiring a bounded date range, topic, record type, or result count instead of permitting unrestricted searches.
5. Redact credentials, authentication tokens, financial data, personal identifiers, and unrelated third-party information before presenting results.
6. Require confirmation before returning full conversation excerpts or records involving people other than the requester.
7. Return summaries by default and reveal source text only after an additional authorization check.
8. Record auditable metadata for memory searches, including the requester, query scope, accessed files, and disclosed records.
9. Document that runtime-level access controls remain mandatory and that enabling the skill must not automatically authorize access to every available memory file.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description uses very broad trigger phrases such as '查找', '找回', '某天', '某次', and '之前说过', which overlap heavily with normal conversation. In an agent system that auto-selects skills from descriptions, this can cause the skill to activate unexpectedly and access or expose historical memory when the user did not clearly intend a memory recall operation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill's natural-language description and examples are entirely in Chinese, with no indication that language selection is optional or limited to a justified Chinese-only deployment context. Under the policy, a fixed language or locale without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.