Security audit

memo-quickstart-free

Security checks for vulnerabilities and agentic risk

Overview

This local memory skill is not clearly malicious, but it asks users to install and run an unaudited global npm package while giving inconsistent privacy, network, and privilege guidance.

Review this skill before installing. Avoid running it as administrator, avoid storing secrets or sensitive personal data, and only use it if you are comfortable installing the simple-local-memory npm package globally or can pin and verify that package yourself. Treat the local-only privacy claims cautiously because the documentation also references callbacks and external API behavior.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:54
Finding: Unpinned Global Installation of an Unverified Third-Party Package
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:427
Finding: Unsafe Recommendation to Run Memory Commands with Administrator Privileges
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill asserts it is fully local and makes zero network requests, yet it defines a callback_url parameter and elsewhere references API/network behavior. This contradiction can mislead users into exposing sensitive memory data to external endpoints under the false assumption that the skill never transmits data off-host.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation says no API key is required, but later sections discuss API-key configuration and authentication failures. This inconsistency undermines trust and may cause users to provide secrets or configure external services they did not intend to use, increasing the chance of credential mishandling.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest markets a zero-dependency local memory tool, but the documented functionality expands into network callbacks and external API integration. This scope mismatch can cause an agent or user to grant broader trust and permissions than appropriate for what is represented as a simple local-memory skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: L012-L013 将技能描述为“适用于需要memo quickstart相关能力的开发场景”“适用于相关开发场景”，但没有给出明确触发短语、适用范围或排除条件。这种表述过于笼统，容易与一般开发协助请求重叠，导致技能被意外调用。
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: A callback_url enables outbound transmission that is not justified by the stated purpose of a zero-cloud local memory quickstart skill. In context, this is especially risky because the skill is designed to collect and persist user preferences, decisions, and contextual data that could be exfiltrated via callbacks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill references callback URLs and external integrations without clear user warning about potential network transmission. Because the skill handles memory content that may include personal preferences, decisions, and contextual notes, failing to warn users materially increases privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The instructions tell the agent to persist user preferences, decisions, deadlines, and corrections before responding. This creates a data-retention risk because sensitive natural-language content may be stored automatically and broadly, without minimization, consent, retention limits, or classification controls.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The example workflow normalizes storing and affirming retention of user statements as memory, reinforcing broad collection behavior. In a memory skill, this context makes the issue more dangerous because the system is specifically designed to accumulate user-generated content over time, increasing privacy exposure if later accessed or transmitted.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: L338-L339 仅提到“触发条件(trigger)与激活方式”，但全文没有提供可执行的明确触发列表、上下文限制或负例说明。对于 markdown 技能说明，这会使调用器难以区分何时应激活该技能、何时不应激活。
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The '主要功能' section lists generic capabilities such as broad file-format processing, external API integration, and sandboxed command execution. These are substantially broader than the manifest's declared purpose of a local memory quickstart based on three-layer storage, TF-IDF retrieval, and WAL logging.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: L006-L010 使用中文显示名和中文摘要，后续文档主体也基本全部为中文，但未说明这是面向中文用户的区域化技能，也未给出语言选择或英文替代说明。若组织要求技能不应强制特定语言而需用户可选，这种默认单一语言呈现可能构成语言策略不合规。
Content: No source excerpt is available for this finding.