Security audit

memddc

Security checks for vulnerabilities and agentic risk

Overview

MemDDC is a project documentation skill, but it broadly scans code, VCS history, config files, user documents, and possible database connections into persistent shared artifacts without enough scoping or sensitivity controls.

Install only for repositories where broad local analysis and persistent generated documentation are acceptable. Before using it on private or production code, exclude secrets and environment files, avoid providing live database credentials, review .memddc contents before committing, and prefer sanitized schema exports or documentation over connection strings.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Warning

Location: SKILL_EN.md:145
Finding: Persistent Poisoning of Agent Constraints Through Untrusted Project Documents
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL_EN.md:47
Finding: Overly Broad Collection of Sensitive Project and Database Information
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL_EN.md:426
Finding: Sensitive Generated Artifacts Are Recommended for Version-Control Sharing
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README advertises automatic full-project scanning and Git commit-pattern analysis, but does not clearly warn users that the skill may access repository-wide source code, derive metadata from version-control history, and write generated artifacts under .memddc/. That lack of disclosure increases the risk of users enabling behavior that exposes sensitive code structure, internal documentation, or developer activity patterns beyond what they expected.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger list includes broad natural-language phrases such as '加载记忆约束修改' and '按DDD契约迭代更新', which are generic enough to be invoked unintentionally during normal conversation. In an agent skill that can scan projects and analyze repository structure, accidental activation could cause unexpected repository-wide analysis or artifact generation without a deliberate user action.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README advertises automatic full-codebase scanning, Git commit pattern analysis, and snapshot/document generation, but provides no warning that repository contents, history, and potentially sensitive code/comments will be processed and persisted locally. In an agent skill context, this can cause users to expose confidential source, secrets, or internal development metadata without informed consent, especially because the behavior is framed as a normal first-use action.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The workflow states that initialization and sync generate and update mem-snapshot.json and documentation automatically, but does not clearly warn that the skill will create or modify files in the user's repository. Silent write behavior in a development tool is risky because it can alter working trees, pollute commits, overwrite local artifacts, or introduce sensitive derived documentation without the user's awareness.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The initialization workflow stores VCS logs, file trees, and integrated business context into persistent snapshots without describing sensitivity checks, retention limits, or segregation of confidential data. This is dangerous because commit messages and structural metadata frequently reveal internal tickets, security fixes, endpoint names, database structure, and other intelligence useful to attackers or inappropriate for broad sharing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs sending VCS logs, file structure data, and user documents to an AI service for analysis, but it does not require user consent, redaction, or any sensitivity filtering first. Those sources commonly contain secrets, internal architecture, personal data, and proprietary business context, so silent transmission to an external model creates a real confidentiality and privacy risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The workflow describes recursive project scanning and persistent writes into a shared .memddc directory, but it does not clearly constrain what may be collected or stored. In team environments this can accumulate sensitive codebase metadata, business docs, and analysis artifacts in a durable shared location that may later be committed, synced, or accessed by unintended users.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill directs scanning user-provided documents and extracting business context into persistent shared memory without any sensitivity boundary or approval gate. User docs often include contracts, customer details, credentials, incident notes, or roadmap information, so centralizing them into reusable memory increases exposure and secondary-use risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger conditions are broad enough to activate on normal repository activity such as ordinary code, config, or directory changes, which can cause the skill to scan and process far more content than the user intended. In a tool that performs deep scanning and writes derived artifacts, this increases the chance of unintended data access, noisy execution, and unauthorized modifications to project documentation state.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill describes automated synchronization, model updates, memory archiving, and consistency verification, but does not prominently warn users that it will write or rewrite files under .memddc and related documentation outputs. Users may therefore trigger it expecting analysis only, while it silently changes repository contents, which can overwrite work, introduce unwanted tracked files, or leak derived project information into shared storage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The active request flow asks for database connection information without any warning that such data is sensitive, secret-bearing, and potentially production-scoped. This can lead users to paste credentials, hostnames, and other confidential access details into the skill context, where they may be mishandled, retained, or used beyond the user's intended scope.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly invites users to provide existing database connection information so it can reverse-engineer the database, which expands its reach from local file/document management into live infrastructure access. That creates a risk of exposing secrets, querying sensitive production data, or encouraging use of privileged credentials without any stated safeguards, environment restrictions, or consent boundaries.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The primary instructions and description are written in Chinese, which can impose a language constraint on users if this README is the main operational guidance. Although there is a link to an English version, the file itself does not explicitly offer a language choice within the skill behavior or document a justified locale restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This skill documentation is presented as an English-specific README with a separate Chinese version link, but it does not explicitly state that language is selectable by user preference within the skill behavior. Because policy violations can arise from fixed language expectations, the absence of an explicit language choice is a mild natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.