T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:113- Finding
Remote installer is downloaded and executed without integrity verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Local Vector Memory Free
Security checks for vulnerabilities and agentic risk
Overview
This local memory skill has a coherent purpose, but it asks users to run unsafe setup commands and persist broad personal details across sessions without enough safeguards.
Install only after reviewing the setup commands and deciding what may be stored. Prefer official package installers or verified downloads instead of curl-to-shell, avoid unpinned npm installs when possible, do not store secrets or regulated personal data by default, and do not add the broad AGENTS.md/SOUL.md memory protocol unless you are comfortable with persistent local logs and have gitignore, permissions, backup, and deletion practices in place.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:263- Finding
Persistent Agent instructions capture broadly defined conversation details
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:123- Finding
Unpinned and unauditable npm dependency installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The skill instructs users to fetch and execute a remote shell script directly with 'curl ... | sh'. This is dangerous because it gives arbitrary code from a network endpoint immediate execution on the host without integrity verification, making compromise of the upstream server, network path, or script distribution channel potentially lead to full system compromise.
- Content
bash # 第 1 步：安装 Ollama（macOS/Linux） curl -fsSL https://ollama.com/install.sh | sh # Windows 用户从官网下载安装包 # https://ollama.com/download
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The command chain pipes downloaded content directly into 'sh', which is a classic chaining pattern that removes the user's opportunity to inspect the fetched script. In this skill context, the risk is heightened because the agent may surface or repeat this command as a recommended setup step, amplifying unsafe execution habits for end users.
- Content
bash # 第 1 步：安装 Ollama（macOS/Linux） curl -fsSL https://ollama.com/install.sh | sh # Windows 用户从官网下载安装包 # https://ollama.com/download
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill promotes storing user details locally and exposes deletion/management operations, but does not prominently warn that sensitive personal, medical, or confidential information may be retained on disk. This is dangerous because users may assume 'local' means 'safe' and provide high-risk data that persists across sessions and may later be exposed, mishandled, or irreversibly deleted.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The WAL/template instructions explicitly encourage writing user details, decisions, deadlines, corrections, and other conversation content into persistent files before responding. This broad capture pattern creates a real data-retention risk, especially because it can normalize storing sensitive information without minimization, consent, or classification controls.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The template recommends ongoing logging across SESSION-STATE.md, MEMORY.md, and dated activity files, which increases the amount and spread of retained conversation data. The context makes this more dangerous because the skill is specifically designed for long-term memory, so over-collection can silently accumulate sensitive history and enlarge the exposure surface.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill declares an extremely broad trigger scope with vague phrases such as general database/storage-related usage, which can cause the agent to invoke this memory skill outside its intended context. In a tool-enabled environment, unclear activation boundaries increase the chance of unintended persistence, retrieval, or deletion of user data without sufficiently specific user intent.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The skill instructions and operational guidance are presented entirely in Chinese, with no indication that users may choose another language or locale. This can violate language-choice policy where skills should not force a specific language without opt-in or justification.
- Content