Security audit

Echoic Memory

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent local memorial-persona generator, but it needs review because it persists AI impersonation instructions and contains unsafe local deletion and media-parsing code around very sensitive personal data.

Install only if you are comfortable processing very private local archives and creating persistent AI persona files. Use only data you are authorized to use, redact third-party and location-sensitive material, keep the echoes directory out of cloud sync, and avoid the delete/rollback/media-analysis paths until slug validation, safe deletion, and eval removal are fixed. The generated memorial should be clearly treated as an AI simulation, not as the real person.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (6)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:374
Finding: Persistent AI Identity Override in Generated Skills
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:336
Finding: Shell Command Injection Through Unvalidated Slug Interpolation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: tools/skill_writer.py:176
Finding: Arbitrary Recursive Directory Deletion in Skill Manager
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: tools/version_manager.py:63
Finding: Path Traversal and Unintended File Overwrite in Version Management
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: tools/media_analyzer.py:43
Finding: Arbitrary Python Evaluation of Untrusted Video Metadata
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
=10.0.0 ``` The installation guide instructs users to execute: ```bash pip3 install -r requirements.txt ``` ### Technical Analysis The lower-bound-only requirement permits pip to install any future Pillow release satisfying the version constraint. The dependency file provides neither an exact audited version nor package hashes. This does not demonstrate that Pillow is malicious. The risk is that installation behavior can change after review, reducing reproducibility and exposing users to a compromised, malicious, or unexpectedly incompatible future release from the configured package index. The project also suggests optional packages through installation messages, but those packages are not centrally pinned in the reviewed dependency file. ### Attack Path 1. A user follows the documented installation command. 2. Pip queries the configured package index. 3. Pip resolves the newest available release satisfying `Pillow>=10.0.0`. 4. The selected package may differ from the version tested during the audit. 5. Package installation and later import execute third-party code in the user's environment. 6. A compromised package release or package-index configuration could affect the Skill process and its sensitive local data. ### Impact Assessment A compromised dependency executes with the privileges of the installing or invoking user. It could access all private media, chats, metadata, and generated persona files processed by the Skill. No evidence of an intentionally malicious package, typo-squatted name, or dependency-confusion package was found. The confirmed issue is the absence of deterministic version and integrity controls. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (70)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README explicitly encourages users to import extremely sensitive data about identifiable people, including private chats, photos, videos, voice memos, and social media, but provides no clear consent, privacy, retention, or legal-use safeguards. In this skill’s context, the data concerns deceased or estranged loved ones and may also expose third parties in conversations, making collection and transformation into an AI persona especially privacy-invasive.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README normalizes extraction of EXIF metadata, timelines, locations, voice traits, and language habits from media without warning that these attributes are sensitive biometric and location-linked data. Because the skill’s stated purpose is persona reconstruction, these processing steps materially increase the risk of identity replication, privacy harm, and unintended disclosure of sensitive personal history.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Unlike the other mismatch findings, this one highlights an undeclared destructive capability: the skill includes deletion of local directories via /delete-echo and /farewell even though the top-level description frames the skill as memorial creation/import. Hidden or underemphasized destructive behavior increases the risk of accidental or socially engineered data loss, especially in an emotionally sensitive context where users may not expect filesystem deletion features.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Unlike the other mismatch findings, this one highlights an undeclared destructive capability: the skill includes deletion of local directories via /delete-echo and /farewell even though the top-level description frames the skill as memorial creation/import. Hidden or underemphasized destructive behavior increases the risk of accidental or socially engineered data loss, especially in an emotionally sensitive context where users may not expect filesystem deletion features.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: Unlike the other mismatch findings, this one highlights an undeclared destructive capability: the skill includes deletion of local directories via /delete-echo and /farewell even though the top-level description frames the skill as memorial creation/import. Hidden or underemphasized destructive behavior increases the risk of accidental or socially engineered data loss, especially in an emotionally sensitive context where users may not expect filesystem deletion features.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Unlike the other mismatch findings, this one highlights an undeclared destructive capability: the skill includes deletion of local directories via /delete-echo and /farewell even though the top-level description frames the skill as memorial creation/import. Hidden or underemphasized destructive behavior increases the risk of accidental or socially engineered data loss, especially in an emotionally sensitive context where users may not expect filesystem deletion features.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Unlike the other mismatch findings, this one highlights an undeclared destructive capability: the skill includes deletion of local directories via /delete-echo and /farewell even though the top-level description frames the skill as memorial creation/import. Hidden or underemphasized destructive behavior increases the risk of accidental or socially engineered data loss, especially in an emotionally sensitive context where users may not expect filesystem deletion features.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Unlike the other mismatch findings, this one highlights an undeclared destructive capability: the skill includes deletion of local directories via /delete-echo and /farewell even though the top-level description frames the skill as memorial creation/import. Hidden or underemphasized destructive behavior increases the risk of accidental or socially engineered data loss, especially in an emotionally sensitive context where users may not expect filesystem deletion features.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: Unlike the other mismatch findings, this one highlights an undeclared destructive capability: the skill includes deletion of local directories via /delete-echo and /farewell even though the top-level description frames the skill as memorial creation/import. Hidden or underemphasized destructive behavior increases the risk of accidental or socially engineered data loss, especially in an emotionally sensitive context where users may not expect filesystem deletion features.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill solicits chats, photos, audio, video, social media, and metadata about real people, including third parties who may not have consented. Failing to prominently warn about the sensitivity of message content, EXIF/GPS data, voices, faces, and social graphs can lead users to disclose highly sensitive personal data without understanding the privacy risks, especially because the use case is emotionally charged and may reduce caution.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 415)May include surrounding context.
md
6. 重新生成 `SKILL.md`（合并最新 memory.md + persona.md）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 428)May include surrounding context.
md
6. 重新生成 `SKILL.md`（合并最新 memory.md + persona.md）

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The skill instructs Bash to run rm -rf echoes/{slug} using a user-influenced parameter. If {slug} is not strictly validated and safely handled, this creates a path traversal or shell-parameter abuse risk that could delete unintended directories; even without command injection, destructive recursive deletion driven by user input is inherently dangerous.
Content: Scanner excerpt · SKILL.md (reported line 450)May include surrounding context.
确认后执行：

bash
rm -rf echoes/{slug}

/farewell {slug}：

eval() call detected

High

Category: Dangerous Code Execution
Confidence: 98% confidence
Finding: The code uses eval() on ffprobe metadata: r_frame_rate comes from parsing an external media file via ffmpeg.probe, so a crafted or unexpected value could cause arbitrary Python expression evaluation. In a skill intended to process user-supplied media from chats, social media, and memorial archives, that makes untrusted input especially likely and materially increases risk.
Content: Scanner excerpt · tools/media_analyzer.py (reported line 54)May include surrounding context.
python
result['width'] = video_stream.get('width') result['height'] = video_stream.get('height') result['duration'] = float(video_stream.get('duration', 0)) result['fps'] = eval(video_stream.get('r_frame_rate', '0/1')) # 音频流信息 audio_stream = next((s for s in probe['streams'] if s['codec_type'] == 'audio'), None)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The tool exposes a recursive delete capability that permanently removes memorial skill directories, which is especially sensitive given the application's preservation-oriented purpose. In this context, accidental or unauthorized invocation could destroy irreplaceable personal memories and associated metadata, causing high-integrity and availability harm.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest describes a skill for preserving a departed loved one’s personality by importing chat history, photos, videos, voice memos, and social media. This file instead implements local backup, rollback, listing, and version increment operations for Skill files, which is a materially different capability from the stated end-user purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file includes commands to clone a GitHub repository and install Python dependencies, which affects the user's local system and executes externally sourced code. While the document states data-handling behavior later, it does not provide any explicit warning near the installation steps about verifying the source or understanding the risks of running these commands.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · INSTALL.md (reported line 22)May include surrounding context.
在你的 git 仓库根目录执行：

bash
mkdir -p .claude/skills git clone https://github.com/yourusername/echomemory .claude/skills/create-echo

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 31)May include surrounding context.
在你的 git 仓库根目录执行：

bash
mkdir -p .claude/skills git clone https://github.com/yourusername/echomemory .claude/skills/create-echo

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · docs/CROSS_PLATFORM.md (reported line 61)May include surrounding context.
在你的 git 仓库根目录执行：

bash
mkdir -p .claude/skills git clone https://github.com/yourusername/echomemory .claude/skills/create-echo

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · INSTALL.md (reported line 22)May include surrounding context.
在你的 git 仓库根目录执行：

bash
mkdir -p .claude/skills git clone https://github.com/yourusername/echomemory .claude/skills/create-echo

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This section instructs users to export highly sensitive private chat histories, including intimate conversations involving deceased or estranged loved ones, without any privacy, consent, retention, or redaction warning. In the context of a memorialization skill, the sensitivity is unusually high because the data may include third-party personal information, secrets, contact details, and emotionally vulnerable content that could be mishandled or retained indefinitely.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 31)May include surrounding context.
Claude Code（项目级）：

bash
mkdir -p .claude/skills git clone https://github.com/yourusername/echomemory .claude/skills/create-echo

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 31)May include surrounding context.
Claude Code(项目级):

bash
mkdir -p .claude/skills git clone https://github.com/yourusername/echomemory .claude/skills/create-echo

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README recommends chat export and decryption tools, including a tool for decrypting WeChat databases, without clearly warning that the resulting archives may contain private messages, account-linked data, and information about uninvolved third parties. Even if external tools are not bundled, endorsing their use in this memorialization workflow raises the chance of users mishandling sensitive archives or using improperly obtained data.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tools/media_analyzer.py:54