Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed local memory-log compression guide with some under-specified safeguards, but no artifact-backed malicious behavior.
Install only if you want a Chinese-language workflow for maintaining agent memory files. Before use, inspect the actual Node script, run it only on intended log files, review the compressed output before appending it to MEMORY.md, and use callback_url only with a trusted endpoint.
The documented callback_url parameter enables sending processing completion notifications to an external URL, but the skill provides no privacy, egress, or trust-boundary warning. In practice, users may supply sensitive logs or metadata and unknowingly allow outbound delivery to third-party endpoints, creating data exfiltration and SSRF-style risk in platforms that honor callbacks.
The skill instructs the agent/user to run file-modifying shell commands such as appending to MEMORY.md and moving logs into memory/archive/ without any warning, confirmation step, backup guidance, or discussion of overwrite/duplication risks. In an agent setting, these commands can silently mutate persistent memory state, create duplicate entries, or relocate source logs in ways that impair auditability and recovery if executed automatically or on the wrong files.
The skill instructions and user-facing documentation are fully in Chinese, but the file does not state that the skill is China-specific or offer an alternative language. This can amount to a language policy issue when users are not given a choice or opt-in regarding locale.
No suspicious patterns detected.
