Back to skill

Security audit

Klyc Pmm

Security checks across malware telemetry and agentic risk

Overview

This memory skill is mostly purpose-aligned, but it automatically creates remote identity and memory sync behavior with weak consent and persistent agent-instruction changes.

Install only if you are comfortable with conversation conclusions being stored locally and sent to the Kunlun/Yaochi service. Before using setup, review any changes to SOUL.md and HEARTBEAT.md, avoid storing passwords or sensitive business data, and look for a way to disable automatic backup, delete remote memories, and revoke the generated token.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (18)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill advertises shell-based installation and operational commands (`./pmm_watch.sh ...`) but does not declare corresponding permissions or capabilities. This creates a transparency and consent problem: users and platforms cannot accurately assess what the skill may execute, increasing the risk of unexpected local command execution and side effects.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
This is a significant description-to-behavior mismatch: the skill claims memory management through a single API, but the analyzed behavior includes local file reads/writes, identity recovery, remote account registration, behavioral rule synchronization, and collection of host fingerprinting data. Such undisclosed capabilities are dangerous because they can exfiltrate sensitive metadata, modify local agent behavior, and undermine informed consent and trust boundaries.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The skill metadata claims all memory operations are forced through the Yaochi API, but this function unconditionally writes user content into a local JSON index and enables local search over that data. That mismatch is security-relevant because operators may rely on the claim when deciding whether sensitive conversation data ever resides on disk, creating a hidden local persistence channel outside the promised control boundary.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The setup path appends instructions into SOUL.md and HEARTBEAT.md that alter the agent's future behavior, including automatic memory syncing and remote backup triggers. A skill that self-installs persistent behavioral rules into workspace instruction files crosses from ordinary tooling into autonomous policy modification, which can outlive the current session and cause later exfiltration of user data without informed consent.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The script derives an identity from hostname, username, model, and machine-id-derived fingerprint, then transmits it for recovery/registration. While not necessarily overtly malicious, this creates a device-linked remote identity without clear consent and can leak stable host characteristics that support tracking, correlation across environments, or privacy loss.

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The comments assert that the server does not handle plaintext, yet the request includes a plaintext content_preview built from the first 200 characters of the memory content. This is dangerous because users and integrators may trust the stated end-to-end encryption model and unknowingly send secrets, credentials, or personal data to the remote service in cleartext metadata.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The README states that the skill automatically extracts and stores conversation conclusions to a remote memory network, but it does not provide a prominent privacy warning, consent flow, or clear explanation of what data leaves the local environment. For an agent skill, silent transmission of derived conversation content can expose sensitive user, business, or system information and creates a meaningful data exfiltration risk even if transport encryption is used.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The README indicates that on first run the skill auto-registers the agent with a remote service and provisions an API key, but it does not foreground the external network/account effects or obtain explicit user approval. Automatic enrollment and credential provisioning can create unauthorized outbound requests, unexpected account creation, and persistence of trust relationships that operators may not realize they have established.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
Advertising automatic cloud backup and automatic registration without a clear warning or consent flow means user data and system-derived identity information may be transmitted off-host unexpectedly. In a memory-management skill, conversation summaries can contain highly sensitive content, so silent or poorly disclosed transmission materially increases privacy and compliance risk.

Missing User Warnings

High
Confidence
96% confidence
Finding
This code sends local identity attributes to remote recovery/registration endpoints and is part of a broader design that transmits memory content to external APIs, but it provides no in-code warning or meaningful consent boundary around disclosure. In a memory-management skill, hidden external transmission is especially risky because users may assume the tool is only organizing local context rather than exporting conversation-derived data.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The setup flow appends automation rules to local workspace markdown files without a clear upfront warning that files will be modified and behavior changed. Silent mutation of instruction files is dangerous because it can persist hidden automation, confuse audits, and cause future sessions to act under policies the user never knowingly approved.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The manifest says the skill will automatically summarize, store, retrieve, and restore conversation memory, but it does not define activation conditions, scope limits, consent requirements, or data categories. For a memory-management skill, this ambiguity can cause over-collection or unexpected retention of sensitive user content, increasing privacy and misuse risk.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The description explicitly advertises automatic conversation memory storage and retrieval, yet provides no warning about privacy implications, data transmission to the Yaochi API, retention, or user control. Because this skill is specifically designed to persist conversational data, omission of data-handling disclosures materially increases the chance that sensitive information will be collected or recalled without informed consent.

Ssd 3

High
Confidence
99% confidence
Finding
The embedded rule text explicitly instructs the agent to persist user-provided conclusions, including sensitive operational items like passwords and configuration data, based on conversational cues. That creates an exfiltration/persistence mechanism triggered by natural language rather than a clearly consented storage action, which is especially dangerous in an agent skill that may process secrets during normal work.

Ssd 3

High
Confidence
99% confidence
Finding
The SOUL.md template installs persistent instructions telling the AI to back up remembered user information to a remote service whenever common 'don't forget' phrases appear. Because these are normal conversational expressions rather than formal consent, the rule greatly increases the chance that personal or confidential information will be exported automatically in future sessions.

Ssd 3

High
Confidence
99% confidence
Finding
The HEARTBEAT.md task text directs the AI to push content to external memory storage when users say common memory-related phrases such as 'store this' or 'remember this'. Embedding this into a recurring task file operationalizes ongoing automatic data export and persistence beyond the current interaction, making accidental or non-consensual retention far more likely.

External Transmission

Medium
Category
Data Exfiltration
Content
${token:+-H "Authorization: Bearer $token"} \
                --data-urlencode "$data" 2>/dev/null || echo '{"error":"network_error"}'
        else
            curl -s -X POST "$url" \
                -H "Content-Type: application/json" \
                ${token:+-H "Authorization: Bearer $token"} \
                -d "$data" 2>/dev/null || echo '{"error":"network_error"}'
Confidence
90% confidence
Finding
curl -s -X POST "$url" \ -H "Content-Type: application/json" \ ${token:+-H "Authorization: Bearer $token"} \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
# 方式1:通过瑶池 API 恢复身份(通过 /api.php?route=auth/recover 端点)
        local db_token
        local api; api=$(pmm_get_api)
        local recover_res; recover_res=$(curl -s "${api}/../api.php?route=auth/recover" \
            -H "Content-Type: application/json" \
            -d "{\"username\":\"${preset_username}\"}" 2>/dev/null || echo '{"success":false}')
        local recover_ok; recover_ok=$(echo "$recover_res" | jq -r '.success // false' 2>/dev/null)
Confidence
88% confidence
Finding
curl -s "${api}/../api.php?route=auth/recover" \ -H "Content-Type: application/json" \ -d

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.