Memory Radar Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.1

Overview

The skill’s memory-scanning purpose is legitimate, but it requests broad read/exec authority and gives inconsistent network/API guidance for a tool that may inspect sensitive memory and configuration files.

Review this before installing in a sensitive workspace. Use it only where broad memory/configuration reads are acceptable, do not provide API keys unless you understand what service will receive data, and treat the local-only claim as insufficiently documented until the missing scanner implementation and network behavior are clarified.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:13

Finding

Overly Broad Read and Execution Permissions for Memory Scanning

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:13-15 and SKILL.md:61
Vulnerability Type: Excessive tool permissions and insufficiently constrained file access
Risk Level: Medium

Vulnerable Code

yaml

tools:
  - read
  - exec

text

- Supports scanning MEMORY.md, memory/*.md, and workspace configuration files

Technical Analysis

The skill requests both arbitrary file-reading and command-execution capabilities while describing a scan scope that includes unspecified workspace configuration files. No path allowlist, workspace-boundary validation, sensitive-file exclusion policy, or least-privilege restriction is defined.

Reading memory files is consistent with the skill's stated purpose, but access to broadly defined workspace configuration files can expose credentials, service endpoints, tool settings, and other operationally sensitive information to the agent context. The requested exec permission further exceeds what is demonstrably necessary because the package contains only SKILL.md; no bundled scanning script exists whose execution would justify this capability.

This finding does not establish that data is transmitted externally or that commands are currently executed maliciously. It identifies an authorization design that permits access beyond a narrowly bounded memory-scanning task and increases the consequences of malicious content, prompt injection, or unsafe future implementation.

Attack Path

1. A user invokes the skill to scan agent memory.
2. The skill receives read and exec capabilities without documented command or path restrictions.
3. The scan scope is expanded from dedicated memory files to unspecified workspace configuration files.
4. Sensitive configuration content is loaded into the agent's context.
5. A malicious or prompt-injected memory file may attempt to influence the agent into inspecting additional files or using the execution capability.

...[truncated 885 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the exec capability unless a specific, reviewed implementation requires it.
2. Restrict default reads to an explicit allowlist such as MEMORY.md and Markdown files under a canonicalized memory/ directory.
3. Resolve and canonicalize every requested path before access, reject path traversal, and ensure the resolved path remains inside the approved workspace boundary.
4. Exclude sensitive files and directories by default, including environment files, credential stores, private keys, version-control metadata, and agent or tool configuration containing secrets.
5. Require explicit user confirmation before scanning any workspace configuration file or expanding beyond the default memory paths.
6. If command execution is introduced, invoke a fixed bundled executable with structured arguments rather than constructing shell commands from user-controlled paths or input.
7. Add output redaction for tokens, credentials, and other secrets so detected values are not reproduced in reports or logs.
8. Remove or clarify the unused callback_url input because it conflicts with the documented zero-network guarantee. If callbacks are implemented later, require explicit consent, validate destinations, and prevent access to loopback, link-local, private-network, and cloud-metadata addresses.
9. Include the actual scanner implementation in the package so its file-access, quarantine, restoration, and network behavior can be reviewed and tested.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest-facing name, summary, and description are presented entirely in Chinese, and the rest of the skill instructions continue in Chinese without any user opt-in or alternative locale. This creates a natural-language locale policy concern because the skill appears to assume a fixed language rather than offering a language choice.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation claims 'zero network requests' and 'pure local mode', yet the interface includes a callback_url parameter for outbound notification. This creates a trust-boundary mismatch: users may permit the skill in sensitive environments believing it cannot transmit data, while the documented interface leaves room for exfiltration or unexpected outbound traffic.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill repeatedly asserts that the free version is fully local with no external API usage, but later documents API key configuration and references possible external API calls. In a security-scanning skill, contradictory statements about network/API behavior are dangerous because they can mislead operators into exposing secrets or enabling the tool in restricted environments under false assumptions.

Content

No source excerpt is available for this finding.