Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
该 markdown 文件将技能描述为“适用于需要memory相关能力的开发场景”“适用于需要简单组织化存储的场景”，但没有给出明确触发短语、边界条件或不应触发的负例。对于会执行读写与命令操作的技能，这种宽泛描述容易与常见对话需求重叠，造成非预期调用。
- Content
Security audit
记忆管理器免费版
Security checks for vulnerabilities and agentic risk
Overview
This is a local memory-writing skill, but its storage location and optional callback URL are under-specified enough that users should review it before installing.
Install only if you are comfortable with the agent creating persistent ./memory/ files in the active workspace. Avoid storing secrets or sensitive personal data, and confirm where files will be written before use; treat callback_url as unclear and do not provide one unless the publisher documents what is sent.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill claims data is stored in the user's home directory, but the operational steps instruct use of ./memory/ in the current workspace. This inconsistency can cause writes to an unintended location, including shared repositories or sensitive project folders, undermining isolation and potentially exposing stored memory data.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill states it does not send network requests, but the documented callback_url parameter implies outbound communication. This contradiction can mislead users into providing sensitive memory content under a false local-only assumption, creating privacy and data exfiltration risk if an implementation uses the callback.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
Including a callback URL parameter without explaining network transmission or privacy implications is dangerous because users may assume the skill is local-only while supplying endpoints that could receive sensitive memory data. In a memory-management context, even metadata or status callbacks can leak personal or project information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill directs immediate writes to local files and index updates without requiring explicit user confirmation or warning about persistence. Because memory entries may contain sensitive personal, project, or credential-like data, silent persistence increases the chance of unintended retention, disclosure, or committing secrets into a workspace.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The skill is documented as a local, immediate-write memory manager with no external services or network requests, yet it defines a callback_url input for async completion notifications. This is intent-level documentation divergence because the declared interface suggests an outbound integration capability that conflicts with the documented local-only, no-network operation model.
- Content
Static analysis
No suspicious patterns detected.