T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:17- Finding
Overprivileged Command-Execution Capability for File Persistence
- Content
View full analysis
- Remediation
View remediation
Security audit
记忆编排器
Security checks for vulnerabilities and agentic risk
Overview
This memory-management skill is broadly coherent, but it asks for command execution and long-term personal memory storage without enough limits or safeguards.
Install only if you are comfortable with an agent keeping persistent local memory about you or your projects. Keep the memory file in a private user-owned directory, avoid storing secrets or regulated personal data, do not run the agent as administrator for this skill, and review any command execution or cleanup/summarization step before allowing it.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:258- Finding
Plaintext and Indefinite Persistence of Identity-Related Memory
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill encourages storing long-term and important memory, including examples involving user preferences and identity-related information, but it does not prominently warn against persisting sensitive personal, confidential, or regulated data. In a memory skill with save/load and persistent storage, this omission materially raises privacy, compliance, and data-exposure risk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The invocation guidance says to use the skill whenever there is 'AI模型调用、智能对话、Agent编排、LLM应用', which is extremely broad and overlaps with many ordinary agent interactions. The description does not provide clear trigger boundaries, exclusions, or specific example phrases to distinguish when this skill should or should not be invoked.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill describes automatic cleanup, FIFO eviction, archiving, deletion, and summarization-based compaction without a clear up-front warning that important data may be lost or transformed. In a memory system, silent cleanup and replacement behavior can destroy evidence, preferences, or business context and may be irreversible once persisted.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The security/compliance section claims protections such as command allowlisting, HTTPS use, and environment-variable secret handling, but the rest of the skill does not substantiate these controls. Unsupported security assurances can mislead users into assuming dangerous operations are already constrained when they may not be, increasing the chance of unsafe exec or persistence use.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is framed as a memory-management tool, but later sections advertise unrelated file processing, API handling, networking, and command-execution troubleshooting. This mismatch can cause agents or users to over-trust the skill’s scope and invoke higher-risk capabilities than expected, especially since the skill declares read/write/exec tools.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The description says '支持中文交互' and the document is written as if Chinese is the intended interaction language, but it does not indicate whether other languages are supported or whether the user can choose their preferred language. This can be a language-policy concern when a skill appears to impose a locale without explicit opt-in or justification.
- Content
Static analysis
No suspicious patterns detected.