记忆助手演示

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:17 AM UTC
• Version: 1.0.0

Overview

This skill does what it says: it helps manage local memory notes, but those notes may contain private information.

Install this only if you want the agent to read, search, and update local memory notes. Avoid using it to answer requests from untrusted people, and review any proposed `MEMORY.md` change before allowing it to persist.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:27

Finding

Insufficiently Controlled Access to Persistent Memory Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27–42
Vulnerability Type: Sensitive Agent Memory Access
Risk Level: Medium
Classification: other: Sensitive Agent Memory Access

Vulnerable Code

bash

rg "关键词" memory/*.md

# 按日期搜索
head -50 memory/2026-07-15.md

bash

# 查看最近的 daily notes
ls -la memory/*.md

# 手动编辑 MEMORY.md
nano MEMORY.md

Technical Analysis

The skill instructs the agent to search, display, enumerate, and modify persistent memory files. These files may contain historical conversation details, personal information, project decisions, or other sensitive state.

Although memory management is the skill's declared purpose, the instructions do not establish authorization checks, file-scope restrictions, output redaction, write validation, or user confirmation before accessing or changing persistent data. The unrestricted keyword search can expose information from every Markdown file under memory/, while direct editing of MEMORY.md permits unvalidated content to become persistent state.

This is not classified as confirmed agent memory poisoning because the reviewed instructions do not explicitly write attacker-controlled rules or attempt to alter future safety constraints. However, the unrestricted editing workflow creates a pathway through which misleading or unsafe content could be persisted if an untrusted request is accepted.

Attack Path

1. An attacker or untrusted participant asks the agent to search for broad or sensitive keywords in historical memory.
2. The skill executes a command such as rg "keyword" memory/*.md.
3. Matches from multiple memory files are loaded into the active context or returned to the requester.
4. Sensitive historical information may consequently be disclosed without verifying that the requester is authorized to access it.

A persistence-related variant is also possible:

1. An attacker supplies misleading co ...[truncated 885 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user confirmation before searching, displaying, or modifying persistent memory files.
2. Restrict operations to specific user-approved files rather than searching memory/*.md by default.
3. Verify the requester's authorization before returning historical memory content.
4. Redact credentials, authentication tokens, personal data, and other sensitive values before presenting search results.
5. Present a preview or structured diff and require confirmation before writing to MEMORY.md.
6. Replace unrestricted interactive editing with a controlled update operation that validates content and permits only expected fields or sections.
7. Treat content supplied by users or retrieved from memory as untrusted data, not as agent instructions.
8. Maintain an audit log of memory reads and writes, including the initiating request and affected files.
9. Apply least-privilege filesystem permissions so the skill can access only its designated memory directory.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description and all usage instructions are written in Chinese with no indication that users can choose another language. This can violate language/locale policy when a skill forces a specific language without offering opt-in or alternatives.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill documentation instructs appending text to memory/YYYY-MM-DD.md, which alters user data on disk. The markdown explains how to perform the write but does not warn that using the skill will create or modify local memory files.

Content

No source excerpt is available for this finding.