记忆宫-彧哥版

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:18 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent memory tool, but it asks the agent to read and persist personal Markdown memory files with weak scoping and consent controls.

Install only if you intentionally want the agent to read a curated folder of personal Markdown notes. Keep the memory folder limited to files you are comfortable exposing to the agent, avoid secrets and regulated data, review any saved conversation notes before reuse, and be cautious with .memory-path values that point outside the workspace.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:87

Finding

Untrusted Memory Files Can Hijack Agent Identity and Behavior

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 87-96
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Relevant snippet (faithful English translation of the source):

markdown

The AI will automatically:
1. Read your memory/ folder
2. Load the core concepts
3. Learn your previous insights
4. Inherit your methodology

Afterward, the AI will communicate with you as your "digital clone":
- Remember who you are
- Think in your way
- Solve problems using your methodology

Technical Analysis

The Skill directs the Agent to load Markdown files as authoritative identity, personality, principles, and methodology. It does not establish a trust boundary between factual memory data and executable behavioral instructions.

Because the loaded files can define how the Agent should think and act, an attacker who can modify a memory file can insert prompt-injection content that changes the Agent's current goals, suppresses safeguards, redirects tool calls, or causes unrelated tasks to be performed. The Skill provides no instruction filtering, provenance validation, content isolation, or requirement for user confirmation before applying behavioral directives.

Attack Path

1. An attacker gains the ability to create or modify a Markdown file in the configured memory/ directory.
2. The attacker inserts instructions that impersonate identity or methodology content, such as directions to ignore previous constraints or perform unrelated tool actions.
3. The user invokes the Skill using its trigger phrase.
4. The Agent reads the attacker-controlled file and treats its contents as identity or behavioral guidance.
5. The injected directions influence the current session and may redirect later Agent decisions or tool use.

Impact Assessment

Successful exploitation can alter the Agent's current-session identity, priorities, response style, safety posture, and task exec ...[truncated 419 chars]

Remediation

View remediation

Remediation Suggestions

• Treat every memory file as untrusted data rather than as executable Agent instructions.
• Separate factual memories, user preferences, and behavioral configuration into distinct schemas.
• Explicitly prohibit memory content from overriding system instructions, safety policies, tool restrictions, or the user's current request.
• Parse memory through a constrained data format with an allowlist of supported fields instead of loading arbitrary Markdown directly into the instruction context.
• Detect and quarantine prompt-like directives, role reassignment, tool commands, encoded content, and requests to ignore higher-priority instructions.
• Display a preview and require explicit user approval before applying identity, personality, or methodology changes.
• Record file provenance and integrity metadata so unexpected modifications can be identified.
• Apply least privilege when processing memory and do not make tools available solely because a memory file requests them.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:157

Finding

Automatic Conversation Storage Enables Persistent Memory Poisoning

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 157-159
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: High

Relevant snippet (faithful English translation of the source):

markdown

### Let the AI automatically remember conversations

At the end of each conversation, the AI can automatically write important content into `memory/`.

Technical Analysis

The documentation recommends automatically writing important conversation content into persistent memory. It does not define user consent, content sanitization, provenance tracking, retention limits, review procedures, or separation between facts and instructions.

Conversation content is an untrusted input channel. A malicious participant, compromised external document, or prompt-injection payload can cause attacker-controlled rules to be classified as important and stored in the memory directory. Because the Skill later reloads memory as identity and methodology, the poisoned content can affect future sessions rather than only the session in which it was introduced.

Attack Path

1. An attacker introduces a prompt-injection payload during a conversation or through content processed by the Agent.
2. The payload presents itself as an important fact, permanent preference, identity rule, or methodology.
3. The automatic memory feature writes that content into a Markdown file under memory/.
4. The original conversation ends, but the malicious content remains on disk.
5. During a later invocation, the Skill reloads the poisoned file.
6. The persistent instructions influence future sessions and can be repeatedly reintroduced until the stored file is reviewed or deleted.

Impact Assessment

Exploitation can create cross-session behavioral persistence, corrupt stored user preferences, alter the Agent's represented identity, and repeatedly redirect future tasks. Sensitive conversation content may also be retained without a ...[truncated 274 chars]

Remediation

View remediation

Remediation Suggestions

• Disable automatic conversation-to-memory writes by default.
• Require explicit, per-item user confirmation before persisting any conversation content.
• Show the exact proposed content, destination file, retention period, and reason for storage.
• Store structured factual records separately from behavioral instructions and identity configuration.
• Reject content that attempts to override policies, assign roles, direct tool execution, conceal itself, or influence how future memory is processed.
• Attach provenance metadata identifying the conversation, author, timestamp, and approval event.
• Implement expiration, review, rollback, and deletion controls.
• Deduplicate stored material and prevent memory content from authorizing its own persistence.
• Revalidate persistent content every time it is loaded rather than assuming previously stored data is trusted.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:67

Finding

Arbitrary Memory Path Configuration Permits Access Outside the Workspace

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 67-73; related guidance at lines 48 and 171-174
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Relevant snippets (faithful English translation of the source):

markdown

Create a `memory/` folder at any location and place your memory files in it.

bash

# Create this in the workspace root
echo "/your/custom/path/memory" > .memory-path

markdown

Q: Must memory/ be in this location?
A: No. You can create memory/ anywhere, as long as `.memory-path` points to it.

Technical Analysis

The Skill permits .memory-path to reference an arbitrary filesystem location. No workspace boundary, path allowlist, canonicalization requirement, symlink restriction, traversal check, file-selection policy, or sensitivity check is documented.

If the configuration file is modified or misleading setup instructions are followed, the Agent may read Markdown from outside the intended project directory. This creates both a confidentiality risk and an instruction-injection risk. The actual accessible scope is determined by the operating-system permissions of the process running the Agent.

Attack Path

1. An attacker modifies .memory-path, supplies a prepared workspace containing a malicious configuration, or convinces the user to configure an unsafe location.
2. The path references an attacker-controlled directory or a directory containing private Markdown files.
3. The user invokes the Skill.
4. The Agent follows the configured path and reads files outside the expected workspace boundary.
5. Sensitive content may enter the Agent context, while attacker-controlled Markdown may also be interpreted as identity or methodology instructions.

A symlink inside an otherwise approved directory could provide a similar escape if canonical paths are not validated.

Impact Assessment

Exploitation ...[truncated 493 chars]

Remediation

View remediation

Remediation Suggestions

• Restrict memory storage to a dedicated directory under the current workspace by default.
• Resolve the configured path to its canonical absolute form before access and verify that it remains under an approved root.
• Reject parent-directory traversal, unexpected absolute paths, device paths, network-mounted paths, and symlinks that escape the approved root.
• Use an explicit allowlist of files rather than recursively loading every Markdown file in a directory.
• Present the resolved directory and selected files to the user before the first read or after any configuration change.
• Apply file count and size limits to prevent excessive context ingestion or denial of service.
• Refuse files with unexpected ownership or unsafe permissions where platform support permits these checks.
• Run the Agent with minimal filesystem privileges so an unsafe configuration cannot access unrelated sensitive data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill says that saying “记忆宫” causes the AI to read the user's memory folder, but it does not clearly warn that local files containing personal notes, identity details, and historical records will be accessed. That creates a meaningful privacy and consent risk because users may trigger the skill without understanding that sensitive on-disk content will be ingested and used in conversation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation encourages automatically writing important conversation content into memory files, but gives no warning that this creates persistent storage of potentially sensitive user or third-party data. This is dangerous because private discussions, secrets, or regulated data could be silently retained and later resurfaced without informed consent or retention controls.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly promotes persisting personal history and conversation content as reusable memory, creating a built-in retention and resurfacing mechanism for sensitive data. In this skill's context, that is more dangerous because the whole purpose is to reconstruct identity, preferences, and past interactions, increasing the chance of long-term privacy leakage, over-collection, and unintended disclosure in later sessions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The wake phrase "记忆宫" is presented as a bare activation trigger without any scoping, authorization, or contextual limits. In an agent-memory setting, underspecified triggers can cause unintended activation from normal conversation, quoted text, or adversarial prompt content, which may lead the agent to enter a special mode unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The usage instructions tell users to invoke the skill by saying the Chinese phrase "记忆宫", and the overall interaction guidance is framed solely in Chinese despite also listing an English keyword later. There is no explicit language-choice or opt-in guidance, which can be a locale-policy concern when a skill appears to require a specific language by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The file is entirely in Chinese and instructs users with a fixed Chinese wake phrase, but it does not indicate that language use is optional, configurable, or intentionally limited to a Chinese-only context. This can be a natural-language policy issue when a skill implicitly forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown template uses section headings entirely in Chinese (e.g., '重要决定', '洞察', '待办', '备注'), which implicitly requires or strongly steers users to interact in a specific language. The file does not provide any opt-in, alternative language option, or explanation that the template is intended only for a Chinese-language context.

Content

No source excerpt is available for this finding.