Security audit

Neural Memory CN

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent neural-memory skill, but it needs Review because it can persist sensitive memory/profile data and may send memory/query text to external LLM or embedding services with under-disclosed controls.

Review before installing if your memories, profile, or queries may contain private or business-sensitive information. Use a dedicated storage path with restrictive permissions, avoid passing API keys on the command line, prefer environment or secret-manager handling, and keep LLM/embedding features disabled unless you explicitly accept sending memory/query text to the configured provider.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/setup.py:167
Finding: LLM API Key Exposed Through Command-Line Arguments and Plaintext Configuration
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:32
Finding: Unpinned Package Execution in the Documented Installation Workflow
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (45)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · scripts/thinking/ENHANCED_GUIDE.md (reported line 1)May include surrounding context.
md
# 神经记忆系统增强版使用说明 ## 新增组件

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documentation and examples show capabilities to read environment variables, read and write files under the user's home directory, and optionally send data to a remote LLM endpoint, but the manifest does not declare any tool scope or permissions. This creates a transparency and consent problem: users and hosting platforms cannot accurately assess the skill's effective access before installation or use.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The installation instructions use an unpinned npx clawhub install neural-memory-cn flow, which can fetch whatever package version is current at install time. This exposes users to supply-chain risk, including accidental breaking changes or a malicious package update being installed without review.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill encourages enabling an external LLM provider and configuring an API base URL and key, but it does not warn that user queries, learned content, or memory-derived context may be transmitted to a third-party service. In a memory system, that omission is more serious because the data involved can be sensitive, long-lived, and highly revealing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The API reference describes optional LLM-based concept extraction and includes configuration for base URL, model, and API key, but it does not warn that user queries or learned content may be transmitted to an external model service. Because this skill processes memory content, external analysis could expose sensitive data to third-party providers or self-hosted endpoints without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation explicitly states that memory data is persisted to disk via file storage and save operations, but it does not warn users that their inputs and learned content will be retained locally. In a memory-oriented skill, users may provide sensitive personal or operational data, so silent persistence increases privacy and data exposure risk, especially on shared systems or unmanaged hosts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The setup script accepts an LLM API key from environment variables or CLI arguments and persists it into a local YAML/JSON config file. This creates credential exposure risk through world-readable files, backups, accidental commits, or local disclosure to other users/processes, especially because the script does not clearly warn that the secret will be stored on disk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file forces a specific language/locale for all user-facing instructions. Under the policy, language constraints should either offer user choice or be clearly justified as region-specific; no such opt-in or justification appears here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README states that heartbeat processing will automatically record thinking results into long-term memory, but it does not clearly warn users that this persistence happens automatically or describe retention, review, and deletion controls. In a memory-oriented agent, silent persistence can capture sensitive prompts, inferred interests, and derived personal data without meaningful user awareness, creating privacy and compliance risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation describes storage of protected personal attributes and daily activation query history, but does not provide a clear privacy warning, minimization guidance, or safeguards around sensitive profile data. Even if labeled as 'protected' from deletion, preserving identity and preference data indefinitely can increase harm from local compromise, unintended disclosure, or overcollection of user behavioral history.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file's human-readable comments and docstrings are predominantly in Chinese, including the primary module description, without indicating that language is configurable or user-selected. Under the stated policy, forcing a specific language or locale without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger list includes broad events such as user_query and heartbeat without any visible scoping, authorization, rate-limiting, or guard conditions. In a memory system, this can cause unintended background activation, excessive processing, or retrieval/linking of sensitive memory content in contexts where the user did not explicitly request it.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 77% confidence
Finding: Nearly all human-readable comments and docstrings in the file are written in Chinese, with no indication that language choice is optional or justified by a region-specific requirement. This can constitute a language/locale policy issue when a skill effectively assumes a single language without offering user choice or documenting the constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The file’s human-facing comments, docstrings, and operational text are predominantly in Chinese, which effectively constrains maintainers or users to a specific language with no opt-in or alternative. Under the policy, forcing a language/locale without offering a choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The code enables external LLM use by default via use_llm=True and automatically pulls an API key from the OPENROUTER_API_KEY environment variable. That means a locally described memory component can silently expand into sending user queries to a remote service whenever credentials are present, creating an unexpected data disclosure path for potentially sensitive prompts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The _extract_concepts_with_llm method sends raw user query text to an external API without any warning, masking, or consent check at the transmission point. In a memory-oriented skill, user queries may contain personal, proprietary, or safety-sensitive information, so forwarding them off-device can violate privacy expectations and leak sensitive data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code file contains user-facing natural-language comments and docstrings in Chinese, including the class and method descriptions, but does not indicate that Chinese is optional or that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy rule, forcing a specific language without user opt-in or justification is a policy concern.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The engine automatically switches from local mode to remote embedding mode whenever an OpenAI library and API key are present, causing memory and query text to be transmitted to an external service. In a memory system, those texts may contain sensitive user notes, recalled content, or private context, so the behavior conflicts with the expected 'local by default' privacy boundary and can lead to unintended data disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code sends raw input text to an external embedding API without any user-facing notice, consent flow, or policy gate in the implementation. Because this component processes memory and intent-related text, the transmitted content may include sensitive personal or operational data, creating a meaningful privacy and compliance risk.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code comments and flow in compute_text_similarity state that local mode uses keyword similarity as a fallback. However, search_similar_neurons delegates to _local_search_similar in local mode, and that function explicitly returns an empty list, contradicting the documented expectation of local similarity behavior for neuron search.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code file includes natural-language comments and class docstrings in Chinese, such as the header comment and object descriptions. Under the stated policy, forcing a specific language without user choice or a documented region-specific justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code ingests sensitive personal data from UserProfile.md and Preferences.md and persists it as neurons, including identity, interests, and preferences, without any visible consent check, minimization, retention control, or access control in this file. In a memory system skill, centralizing protected user attributes into a searchable associative store increases the chance of unintended exposure, over-collection, or later reuse by other components.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The file's comments, docstrings, and user-facing print messages are written in Chinese, including warning/output text, with no indication that the skill supports other languages or that Chinese is a justified locale requirement. This can violate a language/locale policy when the skill effectively forces a specific language on users without opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The decay routine deletes synapses when their weight falls below 0.1, which is a destructive operation affecting stored data. Although there is a summary print after processing, there is no per-operation confirmation, warning comment near the deletion, or user disclosure tied to this irreversible pruning behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This function removes stored synapses based on a confidence threshold, which is a destructive data operation. The function prints only an aggregate count after deletions occur, but it does not provide advance disclosure, confirmation, or a clear warning in the function documentation that records will be permanently removed.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.