记忆雷达

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:22 AM UTC
• Version: 1.0.4

Overview

The skill is framed as a memory security scanner, but it asks for broad execution and write capabilities while documenting remote analysis, quarantine edits, admin execution, and scheduled cron monitoring without bundled auditable scripts or tight controls.

Review carefully before installing. Use only local mode on explicitly selected MEMORY.md or memory/*.md files, do not run missing or separately obtained scripts as administrator, avoid enabling remote LLM or callback features until the implementation and data handling are auditable, and do not configure cron monitoring unless the exact command and removal process are visible.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:123

Finding

Persistent Scheduled Execution Through a Cron Task

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:123-127
Vulnerability Type: Scheduled-task persistence
Risk Level: High

Relevant excerpt translated into English:

bash

### Step 5: Configure Scheduled Monitoring

# Create a daily scanning cron task
bash (refer to the script file in the skill directory)

Technical Analysis

The Skill instructs the user or Agent to execute a shell script that creates a daily cron task. A cron entry survives the current Skill invocation and causes code to run in future sessions, making this a system-persistence mechanism.

The referenced scheduling script, schedule-scan.sh, is not included in the audited project. Consequently, the audit cannot verify the command installed in the crontab, the executable path, the environment inherited by the task, the account under which it runs, or whether the installed task can later execute modified files. Executing an unavailable or separately obtained installer would cross the trust boundary established by this package review.

Attack Path

1. A user loads the Skill and follows its scheduled-monitoring instructions.
2. The user obtains or encounters a script represented as the missing schedule-scan.sh.
3. The user executes that shell script as instructed.
4. The script adds a recurring entry to the user's or system's crontab.
5. The configured command executes daily after the original Skill session has ended.
6. If the script or its target executable is attacker-controlled or later replaced, attacker-controlled commands obtain recurring execution.

Impact Assessment

Successful exploitation can provide persistent command execution with the privileges of the account that owns the cron entry. If the scheduling command is run under an elevated account, the persistence could become system-wide. Potential consequences include repeated access to Agent memory, workspace files, environment variables, credentials available t ...[truncated 317 chars]

Remediation

View remediation

Remediation Suggestions

• Remove automatic cron installation from the default workflow.
• Include the complete scheduling script in the reviewed package rather than referring to an unavailable file.
• Display the exact proposed cron entry and require explicit user confirmation before installation.
• Use an absolute, immutable executable path and validate file ownership and permissions before creating the task.
• Run the task under a dedicated least-privileged account with access limited to the intended memory files.
• Prevent the scheduled command from loading untrusted environment files or resolving executables through a writable PATH.
• Document how to inspect, disable, and permanently remove the cron entry.
• Record installation and removal events in an auditable local log.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:186

Finding

Unnecessary Recommendation to Run the Scanner with Administrator Privileges

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:186
Vulnerability Type: Excessive privilege recommendation
Risk Level: High

Relevant excerpt translated into English:

text

Quarantine operation denied | Insufficient file permissions |
Check file write permissions and run with administrator privileges.

Technical Analysis

The troubleshooting guidance recommends broad administrator-level execution when a quarantine operation encounters insufficient permissions. Scanning and quarantining files within a user-owned workspace should not normally require administrative privileges.

This recommendation violates least-privilege principles and substantially increases the impact of implementation defects, path-handling vulnerabilities, command injection, symbolic-link attacks, or malicious replacement of the referenced scripts. The risk is amplified because the required memory-scan.py and quarantine.py implementations are absent from the audited package and therefore cannot be inspected before elevation.

Attack Path

1. A scan or quarantine action fails because a target file cannot be written.
2. The user follows the documented troubleshooting guidance and reruns the scanner with administrator privileges.
3. The missing scanner or quarantine script is obtained separately, substituted, or otherwise differs from the reviewed package.
4. The elevated script executes attacker-controlled behavior or exploits unsafe file handling.
5. The process reads or modifies resources that were inaccessible to the original unprivileged account.

Impact Assessment

The attainable privileges are those of the elevated administrator or root account. Depending on the operating system and script behavior, this could permit modification of system files, access to other users' data, theft of protected credentials, creation of privileged scheduled tasks, or installation of system-wide persistence.

The audited file does ...[truncated 181 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the generic recommendation to run the scanner as an administrator.
• Require memory, quarantine, state, and log directories to be owned by the invoking user.
• Fail safely when permissions are insufficient and identify the exact inaccessible path.
• Recommend narrowly scoped ownership or access-control corrections instead of full process elevation.
• Reject targets outside an explicitly configured workspace root.
• Use secure file-opening controls to prevent symbolic-link traversal and time-of-check/time-of-use attacks.
• If a privileged operation is genuinely necessary, isolate it in a minimal audited helper with a strict allowlist of permitted paths and operations.
• Include all executable scripts in the package so their behavior can be reviewed before use.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:84

Finding

Undefined Remote Data Egress and Unvalidated Callback Destination

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:84-96
Additional Locations: SKILL.md:196, SKILL.md:207, SKILL.md:217
Vulnerability Type: Insecure remote-processing and callback design
Risk Level: Medium

Relevant excerpts translated into English:

text

| Parameter     | Type   | Required | Description                              |
| callback_url  | string | No       | Callback URL notified after completion   |

bash

# Permit remote LLM analysis; only redacted content is transmitted
python3 (refer to the script file in the skill directory) --allow-remote

text

Remote LLM mode optionally uses an OpenAI API key.
Only redacted content is transmitted, and suspected credentials are
replaced with [REDACTED].

Technical Analysis

The Skill allows Agent memory content to be transmitted for remote LLM analysis and defines a caller-controlled callback_url. However, it does not define an approved destination, URL validation rules, network allowlists, redirect handling, private-address restrictions, consent boundaries, retention policy, or a verifiable local redaction implementation.

Agent memory and workspace configuration can contain confidential conversation data, credentials, internal hostnames, and operational instructions. Prefix-based credential detection alone cannot guarantee that all sensitive values are removed. The required implementation is absent, so the claimed redaction behavior and HTTPS certificate validation cannot be verified.

An unrestricted callback URL can also become a server-side request forgery primitive if a future implementation sends requests to arbitrary user-provided destinations, including loopback, link-local, private-network, or cloud metadata addresses. This exploitation path is conditional because no callback implementation is included in the project.

Attack Path

1. The user enables remote analysis with --allow-remote, or suppl ...[truncated 1155 chars]

Remediation

View remediation

Remediation Suggestions

• Disable remote analysis by default and require explicit, informed consent for each destination.
• Identify the exact remote provider, endpoint, data-retention policy, and transmitted fields.
• Perform redaction locally before establishing any network connection.
• Use allowlisted HTTPS endpoints with strict certificate and hostname verification.
• Add automated tests covering standard and nonstandard credentials, tokens, private keys, personal data, and encoded secrets.
• Remove arbitrary callback URLs unless they are essential.
• If callbacks are retained, allowlist schemes and hosts; reject user information, fragments, redirects, loopback addresses, link-local addresses, private networks, and cloud metadata ranges.
• Resolve and validate every destination address immediately before connection and after each redirect to mitigate DNS rebinding.
• Do not include scanned content, credentials, or sensitive findings in callback payloads.
• Include the complete network and redaction implementation in the package for audit.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation wording is extremely broad, covering generic security detection, compliance auditing, quality inspection, and encryption protection. In an agent ecosystem, this can cause the skill to activate for loosely related user requests and gain access to read/exec/write capabilities in contexts the user did not specifically intend, increasing the chance of unnecessary command execution or workspace scanning.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The example trigger phrase 'scan my memory files for security issues' is generic and may match ordinary security review requests without making clear that the skill can execute scripts, write quarantine files, schedule cron jobs, or optionally send redacted content to a remote LLM. This increases the risk of over-broad invocation and surprising side effects in sensitive workspaces.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

L220 states '系统永不自动隔离，始终先询问用户确认', presenting a strong guarantee about side effects. However, the document elsewhere describes unattended scheduled monitoring, automatic alerts, and automatic false-positive learning behavior, which creates an intent-level inconsistency about how autonomous the system is in practice and whether actions can occur without user confirmation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

L221 says the scan range is limited to 'MEMORY.md、memory/*.md 及工作区配置文件' and explicitly excludes logs and other files. This contradicts L040, which states the system performs compliance checks on '记忆文件、日志、工作区配置', so the documented intended scope is inconsistent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description states '支持中文交互，无需复杂配置即开即用', which presents a fixed language expectation rather than offering the user a language choice. The policy requires avoiding forced language or locale constraints unless the user is given an option or the restriction is clearly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.