Security audit

记忆管理器

Security checks for vulnerabilities and agentic risk

Overview

This local memory skill is not malicious, but it needs review because it encourages automatic long-term storage of user information and has unclear safeguards around shell/file handling and documented data flows.

Install only if you intentionally want an agent to maintain local long-term memory files. Keep categories narrow, avoid storing secrets or sensitive personal/business data, review what is written, keep all paths contained under $HOME/memory/, and ignore callback/API/network features unless the publisher clarifies them.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:225
Finding: Shell Command Injection Through User-Controlled Search Keywords
Content: View full analysis
" $HOME/memory/ ``` The attack succeeds when the Agent passes the resulting stri ...[truncated 789 chars]
Remediation: View remediation
" "" ``` 5. Reject null bytes and control characters before invoking external tools. 6. Use a fixed, canonical memory root rather than incorporating user input into the search root. 7. Run command execution in a sandbox with minimal filesystem and network permissions. 8. Update the operational instructions to make safe argument handling mandatory rather than presenting it only as a general security warning. 9. Add tests using inputs containing quotes, semicolons, command substitutions, redirection operators, newlines, and leading hyphens. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:52
Finding: Path Traversal Through Unrestricted User-Defined Category Names
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill advertises itself for very broad AI/LLM and agent-orchestration scenarios instead of narrowly scoped memory tasks. Overbroad invocation criteria increase the chance the agent will activate this skill in unrelated contexts and start reading/writing long-term files unnecessarily, expanding exposure of user data and file-system side effects.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The description explicitly states '支持中文交互' and the file consistently presents the skill as Chinese-interaction oriented without offering a language choice or opt-in. This can violate language/locale policy expectations when a skill imposes a language preference on users by default.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation makes strong privacy/safety claims that it never sends network requests, yet elsewhere introduces a callback_url parameter and discusses HTTPS/network failure handling. This inconsistency can mislead users and reviewers about the skill's actual data flows, causing them to expose sensitive memory contents under false assumptions of purely local operation.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the agent to immediately persist user-shared information and maintain detailed long-term records about projects, contacts, decisions, and other personal data. Automatic durable storage without explicit per-item consent, minimization, or sensitivity checks risks retaining secrets, personal data, and confidential business information far beyond the user's intent.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Copying information from built-in memory into local files expands the persistence and duplication of potentially sensitive context, creating a second storage location that may be less protected or more broadly accessible. This increases the blast radius of any local compromise and makes accidental retention of sensitive data more likely.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The workflow directs the agent to write user-shared information to memory files without delay, normalizing automatic retention as the default behavior. In the context of an agent with read/write/exec capabilities, this makes inadvertent storage of sensitive conversations materially more dangerous because the user may not realize durable files are being created and updated.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file states no API key is required, but later sections describe API-key leakage, token regeneration, and 401 authentication failures as if external authenticated services are involved. Even if this is partly boilerplate, contradictory security guidance undermines trust and can lead operators to misunderstand dependencies and threat boundaries.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The constraints section says cross-device sync is not built in, which is fine, but the wording '本系统不提供内置同步' broadly states the system provides no built-in sync. Earlier sections explicitly describe '内置记忆单向同步' as a core capability. This is a documentation contradiction about whether synchronization is built in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.