Security audit

Veritas Memory

Security checks for vulnerabilities and agentic risk

Overview

This memory skill is disclosed but overbroad: it directs agents to persist secrets, search historical transcripts, and deploy or restart services without clear user approval gates.

Review before installing. Use only in a tightly controlled single-user environment, and remove or gate the credential storage, transcript-wide search, deployment, and service-restart instructions. Require explicit approval for each secret read/write, each historical transcript search, and each server change, with redaction and clear retention rules.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:95
Finding: System-Wide Credential Discovery and Unscoped Secret Handling
Content: View full analysis
| grep Environment`). 4. Ask the user only after the preceding searches fail. Multi-source scan list: - Project .env files - systemd Environment= entries - /etc/environment - Current process export/environment values - GPG-encrypted CREDENTIALS.md.gpg ``` ### Technical Analysis The Skill is presented as a memory-management system, but its credential workflow directs the Agent to enumerate and modify sensitive configuration across multiple system and server-level locations. The search targets include project-wide `.env` files, systemd unit configuration, `/etc/environment`, and the complete process environment. These locations may contain credentials for services unrelated to the current memory task. The instructions do not establish: - An allowlist of authorized services or paths. - A requirement for explicit user approval before each credential read or write. - Separation between development, staging, and production systems. - Validation that the destination server belongs to the requesti ...[truncated 1712 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:164
Finding: Unrestricted Cross-Session Transcript Harvesting and Plaintext Persistence
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:151
Finding: Mandatory Production Deployment and Service Control Outside the Skill's Legitimate Scope
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Ssd 3

Critical

Category: Not specified by scanner
Confidence: 100% confidence
Finding: This is the strongest issue in the file: the skill instructs immediate indexing, storage, and deployment of any credentials received in chat. That creates persistent copies of secrets, propagates them into operational systems, and encourages the agent to operationalize sensitive data automatically, which can lead to credential leakage, privilege escalation, and unauthorized infrastructure changes.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description claims a fairly advanced memory subsystem with multiple functional capabilities: four-layer memory management, credential indexing, gap detection, deep history retrieval, and deployment-time validation. The supplied code only initializes a set of directories and markdown templates in the current workspace. While some text in the generated files mentions ideas like logs being ground truth and files being cache, the script does not actually implement memory management behavior, indexing, retrieval, validation, or credential-related functionality. Its real purpose is scaffolding a file layout for manual memory keeping, which is materially narrower than the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a substantive memory-management system with multiple architectural layers and advanced behaviors such as credential indexing, gap detection, and deep history retrieval. The supplied code does not implement those capabilities. It only inspects the workspace for expected files/directories (STATE.md, MEMORY.md, memory/, sessions/.jsonl) and prints simple status metrics like counts, sizes, and recent files. While this could be a supporting utility for a memory system, the actual chunk’s primary purpose is health checking, which is materially narrower than the declared purpose.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill treats prior conversation transcripts as reusable memory and explicitly instructs retention and retrieval of sensitive prior content. In context, this is more dangerous because the same document also includes credential indexing and secret lookup rules, making transcript retention a pathway to recover and reuse secrets that should not be broadly accessible.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill tells the agent to immediately persist any credentials received in conversation to indexes, encrypted files, and server environment configuration, without warning the user or requesting consent. This is dangerous because it turns transient secret disclosure into durable storage and deployment, greatly increasing the blast radius of accidental sharing or prompt-triggered exfiltration pathways.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill directs the agent to write credentials into server environments, inspect .env files, query systemd Environment entries, and scan multiple secret stores. This goes far beyond memory indexing and normalizes broad secret handling and secret discovery, which can expose credentials, spread them across systems, and cause unauthorized access if the skill is invoked inappropriately.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: The explicit instruction to place received credentials into .env files or systemd Environment entries is a high-risk secret-handling pattern. Environment files and service definitions are often broadly readable by operators, tooling, backups, or diagnostics, so this can unnecessarily proliferate sensitive material and expose it to lateral discovery.
Content: Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.
markdown
收到凭据 → 本轮回复中立即： 1. 写入 CREDENTIALS_INDEX.md（service → key_name → location） 2. 写入目标服务器 .env 或 systemd Environment= 3. 加密存 CREDENTIALS.md.gpg（如敏感） 4. 验证连通性（curl 测试）

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The lookup flow directs the agent to search credential indexes, .env files, systemd definitions, process environments, and encrypted files before asking the user. This normalizes broad secret discovery from prior data sources and increases the chance of unauthorized retrieval of credentials irrelevant to the present task.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill expands from memory management into deployment and remote service administration, instructing code push, service restart, and live validation. That scope creep is dangerous because a memory-oriented skill can trigger operationally sensitive actions without explicit task-bound authorization, increasing the chance of unauthorized changes, outages, or misuse of privileged access.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The deep-history guidance instructs searching all session transcript files for historical user messages, which may include secrets, private business data, or other sensitive disclosures. In this skill's context, the danger is amplified because transcript search is coupled with credential recovery and operational deployment behaviors.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The startup protocol says '新会话启动时' and later describes behaviors for any time the agent receives incomplete context, but it does not clearly define when this skill should be invoked versus normal conversation handling. Because the manifest and instructions lack explicit trigger phrases, exclusions, or context constraints, the skill's activation scope is overly broad for a markdown skill description.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill instructs shell-based grep over local session transcript files and sub-agent scanning of all session logs. That broadens a memory abstraction into raw local file interrogation, which can bypass normal data minimization boundaries and expose unrelated or sensitive historical content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill authorizes transcript-wide search of local JSONL session logs without warning that historical conversation contents will be scanned. This undermines user expectations of context use and can surface prior sensitive content beyond what is necessary for the current task.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill explicitly instructs the agent to delete completed todos, which is a destructive state-changing action without any requirement for user confirmation, backup, or retention policy details. In a memory-maintenance skill, this can cause loss of audit trail, task history, or context that may later be needed for verification or dispute resolution.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The template and field labels are written entirely in Chinese, including the required title and section names, which implies a fixed language/locale for generated STATE.md content. The file does not offer a user language choice or explain that the format is intentionally region-specific, so this is a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The prompt instructs the agent to modify persistent memory files (STATE.md and potentially MEMORY.md) based on parent-session transcript content, but provides no user confirmation, approval boundary, or visibility into what will be written. In a memory skill, this creates a real integrity and privacy risk: sensitive or attacker-injected content from conversation history can be silently persisted and later influence future agent behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script writes STATE.md content entirely in Chinese, and similar Chinese-only templates are also created later in the file. This imposes a specific language/locale on generated artifacts without offering user opt-in or documenting a justified region-specific requirement, which is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The description mandates a bilingual presentation style by embedding Chinese and English together, and the rest of the document continues in a mixed-language format. Because no user language preference, opt-in, or region-specific justification is provided, this can violate language or locale expectations for organizational policy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The instructions require updating the "当前状态" section and related Chinese-labeled fields, which imposes a specific language/locale in the skill behavior. There is no indication that this language requirement is optional, user-selected, or otherwise justified as a region-specific constraint.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.