记忆编排器免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:36 AM UTC
• Version: 1.0.1

Overview

This skill looks like a basic local memory manager, but it requests command execution and persistent disk storage without enough safeguards.

Review before installing. Use this only for non-sensitive preferences or session notes, avoid storing secrets or private personal data, restrict memory files to a dedicated directory, and do not allow shell execution for this skill unless a concrete reviewed implementation requires it.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:72

Finding

Unrestricted Caller-Controlled Persistence Path

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 72-76; additional usage example at lines 113-117
Vulnerability Type: Unrestricted file path and unsafe local persistence
Risk Level: Medium

Vulnerable Code Snippet

markdown

### 4. 本地持久化

保存记忆到磁盘文件，重启后可加载.
- **参数**：`persistPath`（默认 `./memory-store.json`）
- **用法**：`action: "save"` 保存，`action: "load"` 加载
- **输出**：持久化文件

The caller-controlled path is subsequently demonstrated without any restrictions:

typescript

await skills.memoryOrchestrator({
  action: "save",
  persistPath: "./my-memory.json"
});

Technical Analysis

The Skill directs the Agent to save and load memory through a caller-supplied persistPath, but it does not define any validation, canonicalization, allowlisted storage root, symlink defense, overwrite protection, or file-permission requirements.

Consequently, an implementation that follows the documented behavior directly may accept absolute paths or traversal sequences such as ../../target-file. The documented load operation presents a corresponding unauthorized-read risk if arbitrary paths can be selected. Because the repository contains only SKILL.md and no implementation, the exact runtime behavior cannot be verified; the confirmed defect is that the security-sensitive persistence contract omits required path controls.

Memory entries may contain user preferences or other conversation-derived information. The document also does not require encryption, restrictive file permissions, or filtering of sensitive content before plaintext JSON persistence.

Attack Path

1. An attacker supplies an action: "save" or action: "load" request with a crafted persistPath.
2. The path uses an absolute location, directory traversal, or a symlink under an otherwise allowed directory.
3. The Agent follows the Skill instructions and performs the requested file operation without canonical path validation.

...[truncated 736 chars]

Remediation

View remediation

Remediation Suggestions

• Store all memory files beneath a dedicated, application-controlled directory.
• Reject absolute paths, null bytes, device paths, and path components containing ...
• Canonicalize both the storage root and requested destination, then verify that the destination remains beneath the approved root.
• Do not follow symbolic links; use platform-safe file APIs that prevent symlink races where available.
• Generate server-side filenames or validate identifiers against a strict allowlist instead of accepting arbitrary paths.
• Separate read and write authorization and only permit approved memory-store files to be loaded.
• Use atomic writes through a securely created temporary file followed by an atomic rename.
• Create files with restrictive permissions and document how sensitive memory content is protected or excluded.
• Refuse to overwrite existing unrelated files unless an explicit, validated replacement operation is requested.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:15

Finding

Unnecessary Command-Execution Permission Violates Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15-18; execution classification at lines 198-199
Vulnerability Type: Excessive tool permission
Risk Level: Medium

Vulnerable Code Snippet

yaml

tools:
  - read
  - write
  - exec

The Skill later characterizes command execution as necessary for persistence:

markdown

- **分类**：MD+EXEC（Markdown 指令驱动，部分功能需 exec 执行持久化操作）
- **说明**：基于 Markdown 的 AI Skill，通过自然语言指令驱动 Agent 管理两层记忆系统

Technical Analysis

The manifest grants the general-purpose exec capability even though the documented functionality consists of adding, searching, summarizing, reading, and writing JSON memory data. The Skill contains no concrete operation that requires shell command execution. Local persistence can be implemented through the separately declared read and write tools.

A general command-execution tool is significantly more powerful than file-scoped persistence operations. Granting it expands the impact of prompt injection, malicious memory content, or attacker-controlled input because the Agent may consider shell execution authorized while applying this Skill.

This is a least-privilege failure. The audit found no embedded command or explicit malicious execution instruction, so the issue is the unnecessary availability of the execution channel rather than evidence that the Skill currently runs a specific malicious payload.

Attack Path

1. A user, retrieved memory entry, or other untrusted input includes instructions that encourage the Agent to invoke a shell command.
2. The Agent loads this Skill and observes that exec is an authorized tool.
3. The malicious content is treated as part of a persistence, repair, import, export, or troubleshooting request.
4. The Agent invokes exec instead of using constrained file operations.
5. The command runs with the operating-system privileges and environmental access of the Agent process.

Success ...[truncated 567 chars]

Remediation

View remediation

Remediation Suggestions

• Remove exec from the declared tool list.
• Implement persistence exclusively through narrowly scoped read and write operations.
• Restrict those file operations to a dedicated memory directory and approved file format.
• If a future feature genuinely requires execution, expose a purpose-built operation with fixed arguments instead of a general shell.
• Require explicit user confirmation for any command execution and display the exact command before it runs.
• Run unavoidable commands in a sandbox with minimal filesystem, environment, and network access.
• Treat memory content and user-provided instructions as untrusted data and prohibit them from selecting executable commands.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description is framed broadly for general 'memory orchestrator-related' development scenarios rather than tightly constraining when it should activate. In an agent setting, broad activation can cause the skill to engage on loosely related prompts and handle user data or trigger persistence behaviors unexpectedly, increasing the chance of inappropriate memory storage or misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documents saving memory to a local file path and loading it later, but does not provide a clear warning about privacy, sensitive-data retention, overwrite risk, or filesystem exposure. Because the skill is explicitly designed to store user preferences and session data, this omission can lead to unintentional persistence of sensitive information across sessions or into insecure locations.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The examples explicitly instruct the agent to remember user-provided preferences and persist them to disk for later retrieval across sessions. This creates a direct data retention risk: personal or sensitive information may be stored indefinitely, resurfaced in later contexts, or exposed through logs, local files, or other agents sharing the environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.