Security audit

记忆快速启动

Security checks for vulnerabilities and agentic risk

Overview

This is a local memory skill, but it needs review because it encourages automatic persistent storage of user conversation details and gives inconsistent guidance about network and cloud-sync behavior.

Review this before installing in any workspace with private, regulated, or business-sensitive conversations. Treat the memory files as persistent records, avoid storing secrets or sensitive personal data, verify the npm package before global installation, and do not enable callback or Gist-style sync unless external transmission is acceptable.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The documentation makes materially inconsistent security claims: it says the skill is purely local with zero network requests, while elsewhere it supports callback URLs, HTTPS communication, API-style flows, and optional GitHub Gist sync. This can mislead operators into enabling the skill in environments that prohibit network egress or into handling sensitive data under false assumptions about locality.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The file claims there is no built-in cloud or cross-device sync, yet also advertises GitHub Gist-based sync and network/API-related usage. These contradictions obscure the actual trust boundary and data flow, which is dangerous for a memory tool that stores user preferences, decisions, and context.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documentation directs persistent storage of user information locally without a clear warning, consent gate, or sensitivity filter. Because the stored data includes preferences, decisions, deadlines, and corrections, users may unknowingly have sensitive or regulated information retained on disk.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The maintenance workflow includes archive, deduplicate, export, and cleanup commands that can alter, move, or remove stored files without prominently warning the operator. In a memory system, this creates integrity and availability risk, especially if the commands are automated or run in the wrong directory/context.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The WAL workflow explicitly requires writing memory before responding, causing automatic persistence of user-supplied conversation content. In context, this is more dangerous because the skill is a memory tool handling broad conversational data, so it encourages indiscriminate retention and increases the chance of storing secrets, personal data, or sensitive business context.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The system-prompt guidance instructs the agent to automatically log important user information into persistent storage at session start and during interaction. This creates a semantic privacy risk because the model is encouraged to treat broad conversational content as collectible memory without a strict minimization policy.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The workflow mandates storing user preferences, decisions, deadlines, and corrections, which are often highly sensitive in aggregate and can reveal identity, habits, schedules, or internal project intent. Because the retention is framed as routine behavior, the skill normalizes broad data collection without contextual safeguards.

Ssd 3

Low

Confidence: 89% confidence
Finding: The example demonstrates saving user statements and preferences directly into memory without any sensitivity check, consent prompt, or note about persistence. Examples strongly shape implementation behavior, so this can propagate insecure defaults into downstream agent setups.

Static analysis

No suspicious patterns detected.