Security audit

Memory Treasure

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent memory system, but it asks the agent to persist and reload sensitive conversation-derived memory with broad backup and archival behavior that needs review before installation.

Review this skill carefully before installing. Use it only if you want an agent to maintain local cross-session memory, and exclude secrets, credentials, private keys, raw chats, and sensitive business or personal data unless you add explicit approval, redaction, encryption, retention, and deletion controls.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:9
Finding: Untrusted Conversation Content Can Be Promoted into Persistent Agent Instructions
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:9-16, 99-117, 139-143, 166-172, 195-205
Vulnerability Type: Persistent memory poisoning
Risk Level: High

Evidence

Translated source excerpt from SKILL.md:9-16:

text
## Load at startup Automatically load hot storage at every startup: - Hot/Principles/ — core rules, methodology, and security boundaries - Hot/Insights/ — user insights and assistant insights - Hot/todos/ — pending tasks This module provides hot-storage support for AGENTS.md. AGENTS.md only needs to reference this skill.

Translated source excerpt from SKILL.md:99-117:

text
### Principles (hot, permanent) - Core rules, methodology, and security boundaries - Must be loaded at every startup - Principles require continuous updates ### Insights (hot, permanent) - Record the user's insights when the user states something proactively, repeats it, or corrects the assistant - Record assistant insights when the user praises the assistant - Insights obtained through communication with AI must also be recorded

Translated source excerpt from SKILL.md:139-143:

text
### Hot storage: principles, insights, and todos - Principles/insights: write immediately when triggered - Todos: update when a task is completed or proactively changed - Synchronize todo status at every startup

Translated source excerpt from SKILL.md:166-172:

text
### Hot storage (daily use) - Automatically load at startup: Hot/Principles/ + Hot/Insights/ + Hot/todos/ - Capacity restriction: if substantial reading is required, refine content in batches and then consolidate it

Technical Analysis

The Skill establishes a persistent feedback loop in which statements from a conversation can be promoted into permanent principles or insights and then automatically loaded during later sessions. In particular, user corrections, repeated statements, and AI-derived insights are designated as write triggers.

The design does not requi ...[truncated 2032 chars]
Remediation: View remediation
Remediation Suggestions

Do not automatically convert conversation statements, corrections, repetition, or praise into behavioral rules.

Require explicit, informed user approval for every proposed persistent-memory write.

Store memories as untrusted data rather than executable instructions.

Separate factual profile data, task state, and behavioral policy into independently controlled stores.

Prevent memory entries from modifying system instructions, security constraints, authorization rules, or tool policies.

Record provenance for every entry, including author, source session, timestamp, reason for storage, and approval status.

Add integrity protection and an auditable revision history for persistent rules.

Validate loaded entries against a restrictive schema and reject imperative content from untrusted sources.

Support expiration, rollback, quarantine, and manual review of newly created entries.

Load only entries that have passed a trust review instead of loading entire mutable directories automatically.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:132
Finding: Unredacted Conversation Archives and Sensitive Files Are Included in Persistent Storage and Backups
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:39-47, 88-91, 132-138, 195-205, 211-214
Vulnerability Type: Insecure retention and backup of sensitive data
Risk Level: Medium

Evidence

Translated source excerpt from SKILL.md:39-47:

text
### Cold storage (very low frequency, complete conversation archives) - Write-only and rarely read until vector storage is enabled - Current state: automatically archived every hour - Path: memory/Cold/ChatHistory/YYYY/MM/DD/YYYY-MM-DD-HH.jsonl Cold storage holds complete conversation archives. Hourly cron jobs currently handle automatic archival.

Translated source excerpt from SKILL.md:88-91:

text
ImportantFiles/ # Keys, chat records, the assistant's first session, and similar files

Translated source excerpt from SKILL.md:132-138:

text
### Cold storage: complete conversation archive - Trigger: automatically execute through cron at the start of every hour - Format: raw JSONL with nothing deleted - Maximum file size: 500 KB; automatically create a numbered file when exceeded - Path: memory/Cold/ChatHistory/YYYY/MM/DD/YYYY-MM-DD-HH.jsonl

Translated source excerpt from SKILL.md:195-205:

text
## Writing standard 1. Core understanding and methodology → Hot/Principles/ 2. User insights → Hot/Insights/ 3. Assistant insights → Hot/Insights/ 4. Work output, process documentation, and Q&A → Warm/done/ 5. Pending tasks → Hot/todos/ 6. Complete raw conversations → Cold/ChatHistory/ with nothing deleted

Translated source excerpt from SKILL.md:211-214:

text
## Backup rules When the user says "back up memory": automatically package all memory files locally. Archival principle: retain useful information and periodically remove redundant content.

Technical Analysis

The Skill directs the system to retain complete conversations as raw JSONL without deleting any content. It also describes a directory for important files that explicitly includes keys and i ...[truncated 2575 chars]
Remediation: View remediation
Remediation Suggestions

Prohibit storage of passwords, API tokens, private keys, session cookies, recovery codes, and similar credentials.

Apply secret scanning and structured redaction before any conversation content is persisted.

Use an allowlist of fields that may be archived instead of retaining complete raw conversations.

Obtain explicit user consent before enabling conversation archival and explain the retention period and storage location.

Encrypt archives and backups at rest with keys managed separately from the stored memory.

Restrict file and directory permissions to the minimum required account.

Exclude sensitive directories and detected secrets from bulk backup operations.

Define enforceable retention periods and securely delete expired archives and backup copies.

Maintain an inventory of backup destinations and prevent uncontrolled copying.

Provide users with mechanisms to inspect, export, redact, and permanently delete stored memory.

Replace the instruction to store keys under important files with an explicit prohibition and a reference to an approved secret manager.

If hourly archival is implemented later, ensure the scheduler does not run with elevated privileges and logs only metadata rather than sensitive content.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill defines a broad backup of 'all memory files' while the directory structure explicitly includes 'important files' such as keys. That creates a credible risk of secret exfiltration, over-collection, or accidental redistribution of credentials and sensitive conversation data during backup operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill says complete conversations are automatically archived hourly in raw JSONL 'without deleting a word,' but it provides no user-facing consent, retention notice, or guidance on sensitive data handling. This creates a privacy and compliance risk because users may disclose secrets or personal data without realizing it will be durably stored.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Mandating preservation of full conversations in raw form and coupling that with automatic memory-loading semantics creates a durable data-retention surface that can later be surfaced to the model or user. Even without explicit exfiltration, this increases the blast radius of any accidental disclosure, prompt confusion, or compromise of the local memory store.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases include common conversational terms like '回忆', '恢复状态', and '加载记忆', which can be invoked unintentionally during normal chat. In a skill that automatically loads and manipulates stored memory, broad triggers increase the chance of unauthorized or surprising activation, leading to privacy exposure or unintended state changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The '备份记忆' command packages all memory files locally with no warning that backups may include complete chat logs, todos, insights, or 'important files' such as keys. A one-phrase backup action without scope review or sensitivity warnings materially increases the chance of accidental leakage or insecure local storage of highly sensitive data.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: A command that semantically bundles 'all memory files' creates a straightforward path to broad exposure of stored user data, especially in a system that also retains raw conversation archives and potentially keys. The combination of comprehensive retention plus bulk export makes the skill context more dangerous than a generic note-taking tool.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The template uses a simple wake phrase, "记忆宫殿", with no scoping, authorization, or contextual activation constraints. Broad trigger phrases can cause unintended activation by normal conversation or third-party content, which may lead the agent to load or apply memory behavior when the user did not explicitly intend it.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The cold-storage section says '只写不读' / 'We write but rarely read', implying cold archives are not read during normal operation. Later documentation states that saying '备份记忆' automatically packages all memory files to local storage, which necessarily reads those archived files, so the documentation describes mutually inconsistent behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T02 · Agent Memory Poisoning

Vulnerability Details

Evidence

Technical Analysis

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Evidence

Technical Analysis

Remediation Suggestions

SkillSpector

Context-Inappropriate Capability

Missing User Warnings

Ssd 3

Vague Triggers

Missing User Warnings

Ssd 3

Vague Triggers

Intent-Code Divergence

Static analysis