Security audit

Memory Audit — DDIA+DDD System Health Check

Security checks for vulnerabilities and agentic risk

Overview

This skill is not malicious, but it should be reviewed because it can inspect and change persistent agent memory and behavior files without tight scoping or confirmation.

Install only for workspaces where you intentionally want agent memory audited and repaired. Run diagnosis first, review planned changes before allowing edits, use version control or backups, avoid shared fixed /tmp report paths, and do not enable cron jobs, trace logging, or behavior-rule updates unless you explicitly want those persistent changes.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/audit_baseline.py:233
Finding: Predictable Shared Temporary Files Permit Symlink Overwrite and Audit Tampering
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Note

Location: scripts/audit_baseline.py:60
Finding: Unrestricted Workspace Scope Enables Sensitive Agent-State Reconnaissance
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
Content: Scanner excerpt · references/ddia-ddd-mapping.md (reported line 48)May include surrounding context.
md
## Key Insight Agent memory systems face the **same fundamental challenges** as distributed databases: - Schema drift (free text without constraints) - Replication lag (MEMORY.md not updated after status change) - Split brain (multiple sources of truth for "current project status") - Garbage collection (old decisions never cleaned)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill instructs the agent to run local Python scripts and update workspace files, which implies read/write capability, but it does not declare any explicit tool scope or permissions boundary. In an agent environment, missing scope declarations can cause overbroad authority, making it easier for the skill to modify unrelated files or operate with capabilities the user did not clearly consent to.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The title and primary descriptive content are written in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language audience. This can violate a language/locale policy when no opt-in or justification is provided.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The workflow explicitly tells the agent to execute repair scripts, update IMPLEMENT.md and MEMORY.md, and record traces, but it provides no safety gate, dry-run mode, backup requirement, or user approval step before changing workspace data. Because this skill is designed for 'audit and repair' of memory systems, the modification behavior is central and contextually increases the risk of unintended destructive or integrity-impacting changes.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Line L074 specifies that archived search results should appear with a Chinese prefix ('[归档]'). This imposes a specific language/locale in output, and the file does not indicate user opt-in or a documented region-specific reason for that choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The script hard-codes CST = timezone(timedelta(hours=8)), and the generated report always uses that timezone label. This imposes a specific locale/time representation on all users without offering a choice or documenting a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.