Security audit

记忆管理器免费版

Security checks across malware telemetry and agentic risk

Overview

This memory skill is not malicious, but it needs review because it automatically stores user-shared project, contact, and knowledge details in local indexed files with unclear storage and callback disclosures.

Install only if you are comfortable with the agent saving memory files in the active workspace's ./memory directory. Avoid using it for secrets, credentials, regulated personal data, or private contact details unless you explicitly want those written to local Markdown files and can manage deletion yourself. Treat the callback_url field as under-documented and do not provide one unless the publisher clarifies network behavior.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill's description says data is stored in the user's home directory and that it sends no network requests, but the operational instructions actually direct writes to ./memory in the current workspace. This mismatch can cause users and agents to persist sensitive data in shared repositories or unintended project folders under false assumptions about isolation and locality.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The skill claims it does not send network requests, yet it defines a callback_url input for asynchronous notification. Even if not fully implemented here, this creates ambiguity that could lead an agent or integrator to transmit memory-related data to remote endpoints despite the stated privacy guarantees.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs immediate persistence of user-shared information into long-term local storage without requiring a sensitivity check, consent prompt, or retention warning. In this context, the stored content can include project, personal, or knowledge data, so silent persistence materially increases privacy and data-handling risk.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The workflow normalizes immediate long-term storage of arbitrary user-shared information, including contact and project details, into indexed markdown files. This creates a durable accumulation point for sensitive data that may later be exposed through workspace sharing, backups, indexing, or unintended agent access.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The documented workflow directs the agent to retain user information on receipt and maintain searchable indexes, including people/contact data. In a memory-management skill, that context makes the behavior more dangerous because the core feature is persistent accumulation and retrieval of sensitive natural-language content over time.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.