Security audit

精英长记忆

Security checks for vulnerabilities and agentic risk

Overview

This memory skill is coherent but asks agents to persist and reload broad conversation context across sessions, with optional cloud services, without strong opt-in or scoping controls.

Install only if you intentionally want durable cross-session memory. Review what will be written to local files, vector stores, Git notes, and optional cloud services before enabling it, and avoid using it for secrets, regulated data, private customer information, or workspaces where old context must not resurface automatically.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The skill claims command execution is restricted to pre-approved commands and that user input is not interpolated into parameters, but elsewhere documents command execution patterns that accept runtime arguments such as queries and configuration values. This mismatch can create unsafe operator trust, leading agents to pass user-controlled data into exec-style workflows without proper validation or allowlisting.

Vague Triggers

High

Confidence: 95% confidence
Finding: The activation conditions are so broad that the skill may trigger in many ordinary AI, chat, orchestration, or development contexts, causing persistent memory behaviors to activate unexpectedly. Overbroad matching increases the chance of collecting, storing, or transmitting user data when the user did not intend to use a long-term memory system.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill describes multiple persistent storage layers and optional external services such as SuperMemory and Mem0, but does not present clear, prominent warnings about what data is retained, for how long, or when it leaves the local environment. This creates a meaningful privacy and data-governance risk because users may unknowingly have conversational content persisted or sent to third parties.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The skill explicitly instructs the agent to persist user preferences, decisions, deadlines, and corrections across sessions, which can capture sensitive personal, business, or operational information in natural-language form. Because these records are later reloaded and surfaced, the design creates a durable retention and disclosure channel that may expose data beyond the original interaction context.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The documented inputs and outputs normalize converting ordinary conversation content into persistent memory artifacts across files, vector stores, and graphs. That increases the chance that sensitive context is retained longer than necessary and later disclosed in unrelated sessions or to other tools/services.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The WAL and session-start retrieval workflow instructs the agent to log broad conversational history, corrections, and lessons, then reload them automatically in future interactions. This materially increases the risk of resurfacing sensitive or stale information, including data that users did not expect to persist or that is no longer appropriate to use.

Static analysis

No suspicious patterns detected.