Security audit

Apollo Dream

Security checks for vulnerabilities and agentic risk

Overview

This memory-management skill is not malicious, but it can persist and mutate conversation state with broad automatic triggers that users should review before installing.

Install only if you want the agent to keep local long-term memory and snapshots from conversations. Require explicit approval before it writes memory, snapshots files, compresses context, or deletes details; periodically inspect the .dream and .workflow/snapshots directories; and do not rely on the documented heartbeat/task/topic shell helpers unless their source is separately reviewed.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares no permissions, yet its documented behavior includes reading and writing files, including memory and state artifacts. This creates a trust and review gap: an operator may approve the skill as low-risk while it can persist, modify, or expose local data.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The stated purpose suggests temporary context compression, but the specification expands into persistent decision logging, snapshot management, and long-term workflow state maintenance. This mismatch is dangerous because users may not expect durable storage, retrospective querying, or deletion behavior from a 'memory整理' skill, increasing the risk of privacy leakage and unauthorized state manipulation.

Context-Inappropriate Capability

Medium

Confidence: 85% confidence
Finding: The read_snapshot function accepts an arbitrary file path and opens it without restriction. In an agent context, this can be abused to read sensitive local files if a caller can influence the path, extending the skill beyond snapshot management into general filesystem access.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The create command reads arbitrary external files supplied by the user and stores their contents as snapshots. In a skill intended for memory management, this broad file-ingestion capability can enable collection and persistence of unrelated sensitive data from the local filesystem.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: Broad trigger phrases like '做梦', '记忆整理', and '上下文管理' can activate the skill during ordinary conversation rather than deliberate administrative intent. In this skill's context, accidental activation is more dangerous because activation can lead to file writes, state mutation, context cleanup, and persistence of conversation-derived data.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The activation conditions are vague ('when context needs organizing', 'when AI seems sluggish'), making it unclear when the skill must run versus when it is optional. Ambiguity around activation is risky here because it can justify autonomous execution of persistence, cleanup, or task-state changes without a clear user request.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill describes writing files and deleting data as part of normal operation without a user-facing warning about modification, retention, or cleanup. That is dangerous because users may unknowingly allow durable storage of sensitive context or lose information through automatic forgetting and cleanup.

Missing User Warnings

Medium

Confidence: 76% confidence
Finding: The function persists arbitrary provided content to disk under a hidden workflow directory without any user-facing notice in the code path about storage location, retention, or later deletion. In a memory-oriented skill, silent persistence increases privacy risk because users may provide sensitive notes expecting ephemeral handling rather than durable storage.

Static analysis

No suspicious patterns detected.