Yaoyao Memory Homo

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:53 AM UTC
• Version: 4.0.1

Overview

This memory skill is broadly purpose-aligned, but it exposes sensitive memory and configuration through weak local API controls and can send memory content to external services when configured.

Install only if you are comfortable with a persistent memory system that can read and retain conversation-derived data. Do not run the dashboard/API until route authentication and CORS are fixed. Keep remote embeddings, LLM summaries, cloud sync, MCP, shell embedding, and psychology modules disabled unless you explicitly need them and understand what data and credentials they may expose.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: api_server.py:480

Finding

Unauthenticated Administrative Operations in the Root API Server

Content

View full analysis

0 else b"{}" try: data = json.loads(body) except: data = {} action = path.replace("/api/", "") handlers = { "health_check": lambda: run_health_check(), "backup": lambda: create_backup(data.get("description", "")), "cleanup": lambda: cleanup_expired(), "clear_cache": lambda: clear_cache(), "toggle_feature": lambda: toggle_feature(data.get("feature", ""), data.get("enabled", True)), "search": lambda: search_memories(data.get("keyword", "")), "get_config": lambda: get_config_all(), "set_config": lambda: set_config_item(data.get("key", ""), data.get("value", "")), "delete_config": lambda: delete_config_item(data.get("key", "")), "get_password_status": lambda: get_password_status(), "set_password": lambda: set_password(data.get("password", "")), "verify_password": lambda: verify_password_api(data.get ...[truncated 2644 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/api_server.py:499

Finding

Authentication Bypass and Missing Route Authorization in the Primary API Server

Content

View full analysis

0 else b"{}" try: data = json.loads(body) except Exception as e: print(f"Warning: {type(e).__name__}: {e}") data = {} action = path.replace("/api/", "") handlers = { "health_check": lambda: run_health_check(), "backup": lambda: create_backup(data.get("description", "")), "cleanup": lambda: cleanup_expired(), "clear_cache": lambda: clear_cache(), "toggle_feature": lambda: toggle_feature(data.get("feature", ""), data.get("enabled", True)), "search": lambda: search_memories(data.get("keyword", "")), "get_config": lambda: get_config_all(), "set_config": lambda: (_check_auth(self), set_config_item)[1](data.get("key", ""), data.get("value", "")), "delete_config": lambda: delete_config_item(data.get("key", "")), "get_password_status": lambda: get_password_status(), "set_password": lambda: set_password(data.get("password", "")), "verify_password": lambda: verify_password_api(data.get("password", "")), "remove_password": lambda: remove_password(data.get("password", "")), "snapshot_create": lambda: ...[truncated 2558 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mcp_manager.py:174

Finding

Plaintext MCP Bearer Token Storage and Transmission to Unrestricted Endpoints

Content

View full analysis

dict: """通过 SSE 执行""" headers = {"Content-Type": "application/json"} if token: headers["Authorization"] = f"Bearer {token}" data = json.dumps({"method": method, "params": params}).encode("utf-8") try: req = urllib.request.Request(endpoint, data=data, headers=headers, method="POST") with urllib.request.urlopen(req, context=ssl_context, timeout=30) as resp: return json.loads(resp.read().decode("utf-8")) except urllib.error.HTTPError as e: return {"error": f"HTTP {e.code}: {e.reason}"} except Exception as e: return {"error": str(e)} def _execute_http(self, endpoint: str, token: Optional[str], method: str, params: dict) -> dict: """通过 HTTP 执行""" headers = {"Content-Type": "application/json"} if token: headers["Authorization"] = f"Bearer {token}" data = json.dumps({"method": method, "params": params}).encode("utf-8") try: req = urllib.request.Requ ...[truncated 2063 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/memory.py:58

Finding

Sensitive Memory Text and API Keys Can Be Sent to an Unvalidated Embedding Endpoint

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (655)

Tainted flow: 'req' from os.environ.get (line 95, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 96% confidence

Finding

The script sends conversation text to a configurable external endpoint together with a bearer token sourced from configuration or the environment. Although using an environment variable for a credential is common, the dangerous part is that untrusted or misconfigured base_url values can cause sensitive conversation data and the API key to be transmitted to an unintended remote service, creating a real exfiltration channel.

Content

Scanner excerpt · scripts/backfill_l0_vectors.py (reported line 105)May include surrounding context.

python

)
    
    try:
        with urllib.request.urlopen(req, timeout=30) as resp:
            result = json.loads(resp.read().decode('utf-8'))
            return result['data'][0]['embedding']
    except Exception as e:

Tainted flow: 'req' from os.environ.get (line 182, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 97% confidence

Finding

The script sends l1_records.content to a remote embedding API and authenticates with a bearer token sourced from an environment variable. This creates a real data exfiltration path from a local memory store to an external service, and the environment-derived credential directly enables that network transmission. In the context of a memory system that may contain sensitive cross-session user data, this is dangerous even if intended for embeddings.

Content

Scanner excerpt · scripts/optimize_vector_system.py (reported line 192)May include surrounding context.

python

)
        
        try:
            with urllib.request.urlopen(req, timeout=30) as resp:
                result = json.loads(resp.read().decode('utf-8'))
                return result['data'][0]['embedding']
        except Exception as e:

Tainted flow: 'req' from os.environ.get (line 554, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

This path sends conversation content to the OpenAI API using credentials sourced from environment variables. The core risk is not the env var itself, but that user/system/tool messages may contain sensitive data and are transmitted off-host without sanitization, minimization, or consent, creating a clear data exfiltration/privacy exposure.

Content

Scanner excerpt · scripts/progressive_summary.py (reported line 525)May include surrounding context.

python

req = urllib.request.Request(url, data=json.dumps(data).encode(), headers=headers, method="POST")
        
        try:
            with urllib.request.urlopen(req, timeout=30) as resp:
                result = json.loads(resp.read().decode())
                return result["choices"][0]["message"]["content"]
        except Exception as e:

Tainted flow: 'req' from os.environ.get (line 554, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

This path transmits prompt content to the MiniMax API, again using externally sourced credentials and raw conversation data. In a memory/compression module, that means retained cross-session context can be disclosed to a third party, increasing privacy and compliance risk.

Content

Scanner excerpt · scripts/progressive_summary.py (reported line 557)May include surrounding context.

python

req = urllib.request.Request(url, data=json.dumps(data).encode(), headers=headers, method="POST")
        
        try:
            with urllib.request.urlopen(req, timeout=30) as resp:
                result = json.loads(resp.read().decode())
                return result["choices"][0]["message"]["content"]
        except Exception as e:

Tainted flow: 'req' from os.environ.get (line 55, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/sync_ima.py (reported line 58)May include surrounding context.

python

req = urllib.request.Request(url, data=data, headers=headers, method="POST")
    
    try:
        with urllib.request.urlopen(req, timeout=30) as response:
            result = json.loads(response.read().decode("utf-8"))
            # 兼容两种返回格式：code 或 retcode
            if "code" in result and "retcode" not in result:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

Explicitly documenting a credentials/secrets.env path signals the existence and location of high-value secrets adjacent to the skill workflow. In an AI-agent environment, any unnecessary mention of secret locations increases the risk of accidental disclosure, overbroad tooling access, or prompt-induced attempts to read unrelated credentials.

Content

Scanner excerpt · ADVANCED.md (reported line 24)May include surrounding context.

│ └── memory/ # 记忆文件 │ └── *.md # 每日记忆 └── credentials/ └── secrets.env # 敏感凭证

text

---

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Building a psychological profile from behavior, preferences, and decision patterns is a direct instruction to derive and retain sensitive inferred data. In the context of a persistent memory skill, this is more dangerous because the system is explicitly designed for long-term cross-session storage, making profiling durable, hard to audit, and potentially invasive.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

A shell embedding capability is high risk in the context of a memory system because it is unrelated to the minimum functionality needed for storage and retrieval, yet could enable command execution if exposed through the agent or supporting scripts. In an agent skill ecosystem, unjustified shell access significantly raises the chance of prompt-to-command abuse, privilege misuse, or lateral movement.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 64)May include surrounding context.

md

| 子Agent工具过滤 | ✅ | 危险工具禁止列表 |
| RBAC权限控制 | ✅ | 角色权限分离 |
| Prompt注入检测 | ✅ | 零宽字符检测 |
| 凭证独立存储 | ✅ | `secrets.env` |
| subprocess timeout | ✅ | 所有子进程添加超时 |
| 网络请求timeout | ✅ | 所有HTTP请求添加超时 |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY_FIX.md (reported line 15)May include surrounding context.

md

| 子Agent工具过滤 | ✅ | 危险工具禁止列表 |
| RBAC权限控制 | ✅ | 角色权限分离 |
| Prompt注入检测 | ✅ | 零宽字符检测 |
| 凭证独立存储 | ✅ | `secrets.env` |
| subprocess timeout | ✅ | 所有子进程添加超时 |
| 网络请求timeout | ✅ | 所有HTTP请求添加超时 |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auto_fixer.py (reported line 238)May include surrounding context.

python

| 子Agent工具过滤 | ✅ | 危险工具禁止列表 |
| RBAC权限控制 | ✅ | 角色权限分离 |
| Prompt注入检测 | ✅ | 零宽字符检测 |
| 凭证独立存储 | ✅ | `secrets.env` |
| subprocess timeout | ✅ | 所有子进程添加超时 |
| 网络请求timeout | ✅ | 所有HTTP请求添加超时 |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config_manager.py (reported line 400)May include surrounding context.

python

| 子Agent工具过滤 | ✅ | 危险工具禁止列表 |
| RBAC权限控制 | ✅ | 角色权限分离 |
| Prompt注入检测 | ✅ | 零宽字符检测 |
| 凭证独立存储 | ✅ | `secrets.env` |
| subprocess timeout | ✅ | 所有子进程添加超时 |
| 网络请求timeout | ✅ | 所有HTTP请求添加超时 |

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Audit logging, sensitive-keyword filtering, review/confirmation workflows, failover state, and rollback logs are all privileged governance functions that may record or transform sensitive memory-related content. If persisted to filesystem locations outside the advertised SQLite/FTS5 path, users may not know where sensitive data is retained. In a cross-session memory skill, undisclosed auxiliary logs materially expand the privacy footprint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

Audit logging, sensitive-keyword filtering, review/confirmation workflows, failover state, and rollback logs are all privileged governance functions that may record or transform sensitive memory-related content. If persisted to filesystem locations outside the advertised SQLite/FTS5 path, users may not know where sensitive data is retained. In a cross-session memory skill, undisclosed auxiliary logs materially expand the privacy footprint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

Audit logging, sensitive-keyword filtering, review/confirmation workflows, failover state, and rollback logs are all privileged governance functions that may record or transform sensitive memory-related content. If persisted to filesystem locations outside the advertised SQLite/FTS5 path, users may not know where sensitive data is retained. In a cross-session memory skill, undisclosed auxiliary logs materially expand the privacy footprint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

Audit logging, sensitive-keyword filtering, review/confirmation workflows, failover state, and rollback logs are all privileged governance functions that may record or transform sensitive memory-related content. If persisted to filesystem locations outside the advertised SQLite/FTS5 path, users may not know where sensitive data is retained. In a cross-session memory skill, undisclosed auxiliary logs materially expand the privacy footprint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

Audit logging, sensitive-keyword filtering, review/confirmation workflows, failover state, and rollback logs are all privileged governance functions that may record or transform sensitive memory-related content. If persisted to filesystem locations outside the advertised SQLite/FTS5 path, users may not know where sensitive data is retained. In a cross-session memory skill, undisclosed auxiliary logs materially expand the privacy footprint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

Audit logging, sensitive-keyword filtering, review/confirmation workflows, failover state, and rollback logs are all privileged governance functions that may record or transform sensitive memory-related content. If persisted to filesystem locations outside the advertised SQLite/FTS5 path, users may not know where sensitive data is retained. In a cross-session memory skill, undisclosed auxiliary logs materially expand the privacy footprint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Audit logging, sensitive-keyword filtering, review/confirmation workflows, failover state, and rollback logs are all privileged governance functions that may record or transform sensitive memory-related content. If persisted to filesystem locations outside the advertised SQLite/FTS5 path, users may not know where sensitive data is retained. In a cross-session memory skill, undisclosed auxiliary logs materially expand the privacy footprint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Audit logging, sensitive-keyword filtering, review/confirmation workflows, failover state, and rollback logs are all privileged governance functions that may record or transform sensitive memory-related content. If persisted to filesystem locations outside the advertised SQLite/FTS5 path, users may not know where sensitive data is retained. In a cross-session memory skill, undisclosed auxiliary logs materially expand the privacy footprint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Audit logging, sensitive-keyword filtering, review/confirmation workflows, failover state, and rollback logs are all privileged governance functions that may record or transform sensitive memory-related content. If persisted to filesystem locations outside the advertised SQLite/FTS5 path, users may not know where sensitive data is retained. In a cross-session memory skill, undisclosed auxiliary logs materially expand the privacy footprint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Audit logging, sensitive-keyword filtering, review/confirmation workflows, failover state, and rollback logs are all privileged governance functions that may record or transform sensitive memory-related content. If persisted to filesystem locations outside the advertised SQLite/FTS5 path, users may not know where sensitive data is retained. In a cross-session memory skill, undisclosed auxiliary logs materially expand the privacy footprint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Audit logging, sensitive-keyword filtering, review/confirmation workflows, failover state, and rollback logs are all privileged governance functions that may record or transform sensitive memory-related content. If persisted to filesystem locations outside the advertised SQLite/FTS5 path, users may not know where sensitive data is retained. In a cross-session memory skill, undisclosed auxiliary logs materially expand the privacy footprint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Audit logging, sensitive-keyword filtering, review/confirmation workflows, failover state, and rollback logs are all privileged governance functions that may record or transform sensitive memory-related content. If persisted to filesystem locations outside the advertised SQLite/FTS5 path, users may not know where sensitive data is retained. In a cross-session memory skill, undisclosed auxiliary logs materially expand the privacy footprint.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Audit logging, sensitive-keyword filtering, review/confirmation workflows, failover state, and rollback logs are all privileged governance functions that may record or transform sensitive memory-related content. If persisted to filesystem locations outside the advertised SQLite/FTS5 path, users may not know where sensitive data is retained. In a cross-session memory skill, undisclosed auxiliary logs materially expand the privacy footprint.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: governance.py:84

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: install_modules.py:186

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/governance.py:84

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/install_modules.py:186

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/push_helper.py:120

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/virustotal_scan.py:28

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/backfill_l0_vectors.py:64

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/sync_ima.py:36