Security audit

记忆蒸馏器

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent memory-compression tool, but it can persist and relocate private logs or chat history using an unspecified local Node script without built-in redaction or confirmation safeguards.

Review this before installing if your logs or conversations may contain credentials, customer data, personal information, or confidential work. Only run it on files you intentionally select, inspect or provide the actual memory-compress.js script before allowing exec, and prefer copy/backup plus redaction before appending to MEMORY.md or moving original logs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger list includes broad phrases such as '上下文压缩', '日志归档', and 'memory compress' that can plausibly appear in ordinary user requests outside the intended skill scope. This can cause unintended activation of a skill that has read/exec capabilities, increasing the chance the agent applies file-processing or log-handling behavior when the user did not explicitly request this specific skill.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The workflow instructs archiving or moving original logs with commands like 'mv memory/YYYY-MM-DD.md memory/archive/' but does not require an explicit warning, confirmation, or backup check before relocating user data. Even if intended as maintenance, this can lead to accidental data movement, broken references, or perceived data loss when summaries depend on source paths for traceability.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The '兜底提取' design explicitly prioritizes 'zero data loss' by extracting top items even when matching fails, which encourages retention of all content regardless of sensitivity or relevance. In a log-processing skill, that creates a natural tendency to carry secrets, personal data, tokens, or confidential text from raw logs into derived memory artifacts without any screening step.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The output format and traceability chain require summaries to preserve source references, line numbers, and detailed carry-forward content from raw logs, but there is no sensitivity review or access-control guidance. This increases the risk that compressed summaries become a durable secondary store for sensitive data and also provide a map back to the exact location of secrets or private conversation content in the source logs.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The long-conversation workflow instructs the agent to extract chat history, compress it, preserve several original turns, and reload the compressed context into future conversation state. That behavior can propagate sensitive user-provided information across sessions or tasks, extending retention beyond the user's immediate intent and increasing exposure if later prompts, tools, or summaries access that memory.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.