Echoic Memory

• Outcome: Review
• Latest audit: May 29, 2026 · 9:30 PM UTC
• Version: 1.0.0

Overview

This skill appears intended for local memorial chatbots, but it handles very sensitive personal data and includes unsafe parsing and deletion behavior that should be reviewed before installation.

Install only if you are comfortable storing sensitive chats, photos, voice/video metadata, relationship details, and generated persona files locally. Use copied/redacted data, avoid third-party decryption tools unless you understand the legal and account/privacy risks, get permission for living people’s data where applicable, and back up anything important before using delete or rollback commands. Do not analyze untrusted video files until the eval-based frame-rate parsing is fixed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (25)

eval() call detected

High

• Category: Dangerous Code Execution

Content

result['width'] = video_stream.get('width')
            result['height'] = video_stream.get('height')
            result['duration'] = float(video_stream.get('duration', 0))
            result['fps'] = eval(video_stream.get('r_frame_rate', '0/1'))
        
        # 音频流信息
        audio_stream = next((s for s in probe['streams'] if s['codec_type'] == 'audio'), None)

• Confidence: 99% confidence
• Finding: The code uses eval() on ffprobe-derived metadata via video_stream.get('r_frame_rate', '0/1'). Although this field is expected to be a frame-rate string, media metadata is attacker-controlled through crafted files, and eval can execute arbitrary Python expressions if a malicious value reaches it. In a skill that processes untrusted personal media imports, this is especially dangerous because simply analyzing a file could trigger code execution.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The documentation recommends third-party WeChat export and decryption tools, including direct database extraction workflows, which materially expands the skill from memorialization into potentially invasive data acquisition. In this skill’s context, that is especially risky because the collected content is deeply personal and may include highly sensitive communications from multiple people who did not consent to extraction or AI processing.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: Listing Android/WeChat storage paths, including app-specific directories, encourages users to access data outside the documented import scope and may nudge them toward extracting protected application data. Even if presented as convenience documentation, it lowers the barrier to collecting private app data in ways that may violate platform security expectations or user privacy.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code performs recursive deletion of an entire skill directory via shutil.rmtree on a path derived from user-controlled arguments, with no safety checks, trash/undo, or restriction to known valid skill directories. In a memorialization context, this is especially dangerous because the deleted data may be emotionally sensitive and practically irrecoverable.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The installation guide instructs users to export and process highly sensitive personal data including chat logs, photos, videos, voice messages, and social media content, but it provides only a broad assurance that data stays local and does not describe privacy risks, consent requirements, retention, access controls, or handling of third-party data embedded in those exports. In this skill's context, the data concerns intimate memorialization of real people, making misuse, overcollection, and unauthorized processing especially harmful.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The README explicitly encourages importing extremely sensitive personal data—chat histories, photos, videos, voice memos, and social media—to reconstruct a real person's identity and behavior, but it does not present clear consent, privacy, retention, or third-party data handling warnings. In this context, the absence of guardrails is dangerous because the skill is specifically designed to aggregate intimate data about potentially deceased or otherwise absent individuals who cannot meaningfully consent, increasing the risk of privacy invasion, unauthorized profiling, and emotional/social harm.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The README recommends external tools for exporting and even decrypting private chat data, including WeChat database decryption, without warning users about legality, account risk, platform terms, or the privacy impact on all participants in those conversations. Because the project's purpose is to ingest intimate communications at scale, referencing such tooling without safeguards materially increases the chance of unauthorized access to private data and misuse of data from non-consenting third parties.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases include very broad grief-related language such as '我想念 ta' and '我想跟 XX 说说话', which can match ordinary emotional conversation rather than an intentional request to activate a data-ingesting skill. In this context, accidental activation is risky because the skill immediately steers users into supplying highly sensitive memorial, relationship, and personal-history data.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The English triggers like 'I want to remember someone' and 'I miss them' are common conversational phrases and are not strong indicators of consent to launch a memorial-building workflow. Because this skill can ingest chat logs, photos, audio, and metadata, unintended activation can lead to oversharing of very sensitive personal data.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill handles extremely sensitive material about real people—chat histories, photos, audio, social media, and biographical details—but the user-facing description does not prominently warn about the sensitivity, persistence, and potential privacy implications of collecting and storing that information. In a grief-focused context, users may be emotionally vulnerable and less likely to appreciate the privacy consequences at the moment of consent.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The guide instructs users to export and process chat logs, photos, audio, and videos without an adequate warning about sensitivity, consent, retention, or downstream AI exposure. Given the skill’s purpose of reconstructing a loved one’s personality, the imported material is unusually intimate, so weak privacy guidance meaningfully increases risk of misuse, overcollection, and accidental disclosure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document recommends third-party export utilities and cloud transfer methods for highly sensitive personal data without describing malware, account compromise, confidentiality, or integrity risks. In this context, users may trust the memorialization workflow and expose large volumes of intimate data to unvetted tools or cloud services, increasing the likelihood of privacy breaches.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The PRD explicitly supports importing extremely sensitive personal data such as chat logs, photos, audio, video, and social media content to recreate a deceased person, but it does not require explicit consent checks, provenance verification, retention limits, or prominent user warnings about privacy and impersonation risks. In this skill context, that omission is more dangerous because the system is designed to aggregate intimate, multi-source memorial data, which raises risks of unauthorized processing of third-party data, non-consensual digital resurrection, and severe emotional harm if mishandled.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The correction mode is triggered by very broad phrases like '错了' or '应该是...', which are common in ordinary conversation. In this skill, entering correction mode can change stored memory/persona data, so a normal conversational utterance may unintentionally cause persistent profile edits and drift the reconstructed identity over time.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The workflow instructs the system to update memory.md/persona.md and append correction logs, but it does not disclose to the user that their messages will be persistently written into long-lived files. In a memorial/identity-preservation skill handling intimate personal history, undisclosed persistence creates privacy, consent, and integrity risks, especially because sensitive corrections may be stored indefinitely.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The intake flow explicitly solicits highly sensitive personal data about deceased or estranged individuals, including relationship details, death or disappearance context, age, timelines, personality traits, and intimate memories, yet provides no notice about storage, processing, retention, consent, or downstream use. In a memorialization skill that later imports chats, photos, videos, voice memos, and social media, this omission is especially dangerous because users are emotionally vulnerable and may disclose both their own sensitive data and third-party data without understanding privacy risks.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The template explicitly instructs extracting precise timestamps and location data from chat metadata and photo EXIF, which can reveal highly sensitive personal information about both the deceased/missing person and the user. In this skill’s context—memorializing a loved one using intimate chats, photos, videos, voice memos, and social media—the data is unusually sensitive, and the prompt provides no consent warning, minimization guidance, or restriction on collecting exact metadata.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The prompt instructs the system to update stored Life Memory/Persona data, bump versions, append changelogs, and regenerate SKILL.md, but it does not require explicit user confirmation, preview, or rollback before altering persisted records. In this skill's context—processing highly sensitive memorial, relationship, and identity data—silent merges can overwrite or distort a person's digital representation and cause privacy, integrity, and emotional harm.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The tool writes highly sensitive photo-derived metadata, including GPS coordinates, timestamps, device make/model, and the source directory, directly to a JSON output file without minimization, consent prompts, or privacy warnings. In the context of a memorial/personality-distillation skill that aggregates intimate personal data, this can expose home/work locations, routines, travel history, and other sensitive information if the output is shared, synced, or accessed by another process.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The delete operation irreversibly removes the target directory tree without any confirmation prompt, dry-run mode, or warning. For a command-line tool managing memorial data, accidental invocation or misuse can cause severe data loss, and the emotional context makes the consequence more serious than ordinary file cleanup.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The rollback operation overwrites live skill files from a backup version immediately, with no confirmation prompt, dry-run mode, integrity check, or warning. If invoked accidentally or with an attacker-controlled slug/version in a broader workflow, it can silently destroy newer content or restore stale or tampered files, which is especially risky in a memorialization context where data integrity matters.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The tool writes extracted conversation content to a JSON output file without any explicit warning, confirmation, minimization, or protection of highly sensitive personal data. In the context of a memorialization skill focused on a loved one, the parsed chats are especially intimate, so silently persisting them increases the risk of privacy exposure through accidental sharing, insecure storage, backups, or multi-user systems.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The core purpose of the skill is to ingest broad categories of intimate personal data and reconstruct a persistent persona of a real person. Even if the intent is memorialization, this creates meaningful privacy and dignity risks because the system is designed to aggregate and preserve sensitive communications, media, and inferred traits in durable artifacts.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: These instructions direct the agent to gather user memories and source materials and transform them into persistent local files such as memory, persona, and metadata documents. The danger is not remote exfiltration but long-lived local retention of highly personal, emotionally sensitive, and potentially third-party data that may later be accessed, copied, or misused.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The generated artifacts are designed to embed full memory and persona content, profile fields, and source-file references into persistent files under `echoes/{slug}/`. This materially increases privacy risk because intimate facts, relationship details, departure context, and derived behavioral traits are consolidated into reusable files that could expose both the subject and other people appearing in the source material.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tools/media_analyzer.py:54