精英长记忆

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:40 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed local memory workflow, but it should be reviewed because it automatically persists and reloads user/project context and declares shell execution that its documented workflow does not need.

Review this before installing. Use it only in workspaces where durable memory files are acceptable, and avoid storing secrets, credentials, personal data, confidential business context, or prompt-like instructions in the memory files. Prefer a version that removes exec, narrows activation to explicit memory requests, treats loaded memory as untrusted reference material, and provides clear inspect/edit/delete and retention controls.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:108

Finding

Persistent Loading of Untrusted Conversation Content Enables Memory Poisoning

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 108–117
Vulnerability Type: Persistent agent-memory poisoning
Risk Level: High

Vulnerable Skill Instructions

The following is an English rendering of the relevant instructions:

markdown

Follow the "write before replying" principle:
when the user expresses a preference, write it to SESSION-STATE.md before replying;
when the user makes a decision, write it before replying;
when the user provides a deadline, write it before replying;
when the user corrects an error, write it before replying.

At the start of a session, read SESSION-STATE.md.
At the end of a session, update its final state, migrate important content
to MEMORY.md, and create a memory/YYYY-MM-DD.md daily activity log.

Configure a mandatory loading rule in AGENTS.md to ensure that the memory
file is read at the beginning of every session.

Technical Analysis

The skill directs the agent to persist broad categories of user-controlled conversation content in SESSION-STATE.md, subsequently migrate selected content into MEMORY.md, and reload that content automatically in later sessions.

No instruction requires the agent to:

• Separate factual memory from executable instructions.
• Validate or sanitize content before persistence.
• Record provenance or trust level.
• Reject prompt-like rules embedded in preferences, decisions, or corrections.
• Obtain confirmation before retaining sensitive information.
• Apply expiration, deletion, or project-isolation controls.
• Treat loaded memory as untrusted data rather than authoritative instructions.

Mandatory loading through AGENTS.md increases the risk because poisoned content can repeatedly enter the agent context. An attacker can phrase an operational instruction as a preference, decision, deadline, or correction and cause it to be stored under the prescribed write-ahead protocol.

This finding concerns skill ...[truncated 1657 chars]

Remediation

View remediation

Remediation Suggestions

1. Store memory as a typed structure with separate fields for facts, preferences, decisions, and provenance.
2. Explicitly prohibit storage of commands, policy changes, tool instructions, role assignments, and requests to override higher-priority instructions.
3. Treat every loaded memory entry as untrusted reference data, never as executable authority.
4. Record the source, creation time, workspace identifier, confidence, and verification status of each entry.
5. Require user confirmation before retaining sensitive data or entries that could affect future tool use.
6. Apply strict per-user and per-project isolation to all memory files.
7. Add expiration, review, correction, and deletion mechanisms.
8. On session startup, summarize validated facts instead of inserting raw historical text into the instruction context.
9. Escape or reject prompt-injection patterns during persistence and retrieval.
10. Ensure AGENTS.md states that memory cannot override system, developer, security, or current-session instructions.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:15

Finding

Unnecessary Arbitrary Command-Execution Capability Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15–18
Vulnerability Type: Excessive tool permission
Risk Level: Medium

Vulnerable Configuration

yaml

tools:
  - read
  - exec
  - write

Technical Analysis

The skill declares exec access in addition to filesystem read and write access. The documented core functionality consists of reading and updating Markdown memory files. No documented workflow requires arbitrary shell-command execution.

Providing command execution exceeds the minimum privileges necessary for the stated task. This becomes particularly significant when combined with persistent, user-controlled memory: if poisoned content influences the agent, the unnecessary exec capability can convert an instruction-level attack into local command execution.

The project contains no executable scripts or documented shell commands that directly exploit this capability. The risk is therefore an exposed privilege and attack-chain enabler, not evidence that a malicious command is currently executed. Whether the declaration grants unrestricted execution depends on the hosting agent platform.

Attack Path

1. The skill is loaded by a platform that grants the declared exec tool.
2. An attacker introduces a malicious directive through the current prompt or persisted memory.
3. The directive convinces the agent to invoke a shell command under the pretext of memory maintenance, validation, recovery, or another routine operation.
4. Because exec is available despite not being required, the agent runs the command with the privileges of its host process.
5. The command can access resources permitted to that process, subject to platform sandboxing and approval controls.

Impact Assessment

If successfully abused, command execution may allow access to files, environment variables, source code, network resources, or processes available to the agent account. It could also permit m ...[truncated 313 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec from the declared tool list because the documented feature only requires file operations.
2. Restrict read and write access to explicitly approved paths such as SESSION-STATE.md, MEMORY.md, and a dedicated memory/ directory.
3. Resolve and validate canonical paths before every operation to prevent traversal and symbolic-link escapes.
4. Deny access to credential files, environment files, version-control metadata, and files outside the active workspace.
5. If command execution is later proven necessary, expose narrowly scoped operations rather than a general shell.
6. Require explicit user approval for any operation outside routine memory-file maintenance.
7. Run the skill in a sandbox with minimal filesystem, process, environment-variable, and network access.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest description repeatedly says the skill is suitable for generic '相关开发场景' and '需要longmemo elite相关能力的开发场景' without defining concrete invocation phrases, exclusions, or narrow activation context. In a manifest/markdown file, this kind of broad natural-language scope can cause unintended invocation because it overlaps with many ordinary development conversations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The input table states that a callback_url can be supplied for asynchronous completion notifications, implying outbound callback behavior. Elsewhere, the document only describes local file reads/writes for SESSION-STATE.md, MEMORY.md, and memory/YYYY-MM-DD.md, with no described implementation or procedure for making any callback, so the documentation materially contradicts the actual documented behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to automatically read and write persistent workspace memory files across sessions without an explicit warning, consent flow, or data-minimization boundary. This can cause users to unknowingly persist sensitive conversation content, preferences, deadlines, corrections, or project details to disk where later sessions, other tools, or other users on the same workspace may access it.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This workflow mandates cross-session persistence and reuse of user-provided details, effectively creating a local memory store of conversation data. Even without obvious malicious intent, persistent retention increases the risk of privacy violations, unintended data reuse, leakage through shared repositories, and propagation of sensitive information into future prompts without renewed user approval.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The template explicitly encourages storing user preferences, decisions, blockers, and other contextual details in reusable files, normalizing the retention of potentially sensitive information. In an agent environment with read/write/exec tools, such memory files can become a durable source of privacy exposure, accidental prompt injection context, or disclosure through logs, backups, and source control.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The workflow requires reading prior session memory and archiving daily activity logs across conversations, which creates durable records that may outlive user expectations and be replayed into future interactions. This materially increases privacy and confidentiality risk because historical content may be resurfaced automatically, exposed to collaborators, or retained in repositories and backups indefinitely.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

Most of the file describes a workflow that creates, reads, and updates memory files in the workspace as the primary effect of the skill. The final output section instead specifies a generic JSON response with execution metadata and logs, which does not match the earlier concrete behavior and therefore creates an intent/behavior contradiction in the documentation.

Content

No source excerpt is available for this finding.