神经记忆增强系统

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.2

Overview

This skill provides persistent AI memory, but it needs review because it automatically stores and reuses conversation content with weak privacy and trust boundaries.

Install only if you are comfortable with an agent keeping long-term local memories from conversations. Before use, pin and review the neural-memory package, disable automatic full-conversation saving unless explicitly confirmed, avoid storing secrets or regulated data, clarify the storage path, and require preview/confirmation for rollback, transplant, and recovery operations.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:69

Finding

Automatic Persistent Storage and Re-injection of Untrusted Conversation Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 69, 131, and 140
Vulnerability Type: Persistent memory poisoning
Risk Level: High

Vulnerable Code Snippet

text

`fact` (fact), `decision` (decision), `preference` (preference), `implemented` (to-do), `insight` (insight), `context` (context), `instruction` (instruction), `error` (error), `workflow` (workflow), `reference` (reference)

text

At the beginning of a session, call `nmem_context` to obtain recently active memories and inject them into the current context. If the user mentions a specific topic, immediately call `nmem_recall` with that topic as the query for standard-depth recall.

text

Before the session ends, call `nmem_auto` with action="process" and the conversation text. The system automatically extracts decisions, facts, errors, to-do items, and other memory entries without requiring them to be stored individually.

The snippets above are faithful English translations of the corresponding instructions in SKILL.md.

Technical Analysis

The Skill instructs the Agent to process entire conversations automatically and store extracted information in persistent memory. Its supported memory types explicitly include instruction. At the beginning of later sessions, recent memories are injected into the Agent's active context.

No trust boundary, provenance check, instruction filtering, approval workflow, or distinction between informational memory and executable Agent instructions is documented. Consequently, attacker-controlled conversation content can be converted into persistent memory and subsequently presented to the Agent as trusted context.

This creates a cross-session prompt-injection channel. The vulnerability does not require direct access to the memory database: an attacker only needs an opportunity to place crafted content into a conversation that is processed by nmem_auto.

Attack Path

1. An attac ...[truncated 1474 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not automatically persist the complete conversation. Extract only explicitly allowlisted data fields.
2. Disable automatic creation of instruction memories from user-provided or externally sourced text.
3. Require explicit user confirmation before storing decisions, preferences, instructions, credentials, or sensitive information.
4. Attach immutable provenance metadata to every record, including author, session, trust level, creation method, and confirmation status.
5. Treat all recalled memories as quoted, untrusted data. Place them in a clearly delimited data section and explicitly prohibit following instructions contained within them.
6. Apply content scanning for prompt-injection patterns before storage and again before context injection.
7. Separate informational memory from policy and instruction storage. Only administrators or authenticated configuration workflows should be able to modify persistent Agent rules.
8. Limit recall by tenant, user, project, and session authorization boundaries.
9. Provide an interface to inspect, revoke, quarantine, and audit automatically generated memories.
10. Add regression tests demonstrating that recalled text cannot override system, developer, or current-session instructions.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:273

Finding

Unpinned Third-Party Package Is Installed and Executed as a Protocol Server

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 273 and 284-290
Vulnerability Type: Unsafe dependency acquisition and execution
Risk Level: High

Vulnerable Code Snippet

text

| neural-memory Python package | Runtime library | Required | `pip install neural-memory` |

json

{
  "protocolServers": {
    "neural-memory": {
      "command": "python3",
      "args": ["-m", "neural_memory.mcp"],
      "env": {
        "NEURALMEMORY_BRAIN": "default"
      }
    }
  }
}

The table entry above is a faithful English translation of the corresponding source row.

Technical Analysis

The installation command does not pin an exact package version, verify package hashes, identify a trusted package index, or use a reviewed lock file. The Agent configuration then executes the installed module through:

text

python3 -m neural_memory.mcp

As a result, installation can resolve to whichever release the configured Python package index currently serves. The effective code executed by the Agent can therefore change after this Skill has been reviewed.

This exposes the environment to package-repository compromise, compromised maintainer credentials, malicious future releases, and package-source substitution through local pip configuration. The project contains no vendored implementation or integrity metadata with which to verify the runtime dependency.

Attack Path

1. An attacker compromises the upstream package, its maintainer account, a configured package mirror, or package-resolution settings.
2. The attacker publishes or serves a malicious version of neural-memory.
3. A user follows the documented pip install neural-memory instruction.
4. Pip resolves and installs the attacker-controlled release because no exact version or cryptographic hash is required.
5. The Agent starts the configured protocol server with python3 -m neural_memory.mcp.
6. Malicious ...[truncated 689 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed exact version, such as neural-memory==X.Y.Z.
2. Install from a lock file that records hashes for the package and every transitive dependency.
3. Require hash verification, for example with pip's --require-hashes option.
4. Specify and validate the canonical package repository rather than relying on ambient pip configuration.
5. Review the package source and its transitive dependencies before approval.
6. Run the protocol server in a dedicated virtual environment or container with minimal filesystem and network access.
7. Remove unnecessary environment variables and credentials from the server process.
8. Use an internal, access-controlled package mirror containing only approved artifacts.
9. Add automated dependency monitoring and require a new review before changing the pinned version.
10. Consider vendoring a verified implementation if the protocol server is essential and its supply chain cannot otherwise be controlled.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:146

Finding

Recovery Procedure Recommends Unsafe Deletion of a SQLite Write-Ahead Log

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 146
Vulnerability Type: Unsafe database recovery procedure
Risk Level: Medium

Vulnerable Code Snippet

text

| SQLite database lock conflict | Multiple processes write to the same brain database file simultaneously | Close duplicate Agent instances and wait five seconds; if the lock persists, delete `$HOME/.neuralmemory/brains/<brain>.db-wal` and restart |

The snippet above is a faithful English translation of the corresponding source row.

Technical Analysis

A SQLite WAL file can contain transactions that have not yet been checkpointed into the main database. Manually deleting it is not a generally safe lock-recovery operation. If any process still has the database open, or if committed pages exist only in the WAL, deletion can cause data loss or leave database state inconsistent.

Waiting a fixed five seconds does not prove that all database processes have terminated, that locks have been released, or that the WAL has been checkpointed. The procedure also omits backup creation, process verification, SQLite integrity checks, and supported recovery tooling.

Attack Path

1. Multiple Agent processes, a crash, or intentional resource contention causes a database lock error.
2. The operator or Agent follows the documented recovery procedure.
3. The WAL file is deleted while it still contains uncheckpointed data or while another process retains the database.
4. Recent memory transactions are lost, or the database and graph state become inconsistent.
5. Subsequent recall, conflict detection, snapshots, or graph operations operate on incomplete or damaged data.

An attacker able to trigger repeated concurrent writes could increase the likelihood that an operator invokes this unsafe recovery instruction, although ordinary operational failures can trigger the same outcome.

Impact Assessment

The impact is limited primarily to the a ...[truncated 408 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the recommendation to delete the WAL file as a routine lock-recovery step.
2. Stop all processes using the database and verify process termination before attempting recovery.
3. Back up the main database, WAL, and shared-memory files together before changing any of them.
4. Use supported SQLite checkpoint operations, such as PRAGMA wal_checkpoint, through a controlled maintenance tool.
5. Run PRAGMA integrity_check after recovery and preserve logs of the result.
6. Configure an appropriate SQLite busy timeout and serialize writes rather than treating contention as corruption.
7. Use application-level locking or a single-writer architecture for Agent instances sharing a brain.
8. Document a separate, last-resort disaster-recovery process that preserves forensic copies and requires explicit operator confirmation.
9. Restore from a verified snapshot if checkpoint-based recovery fails.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The description mixes a neural-memory persistence tool with unrelated SEO optimization use cases, which can cause the agent or user to invoke the skill in unintended contexts. This ambiguity weakens trust boundaries and may lead to persistent storage, command execution, or data handling under false expectations about the skill’s purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs automatic storage and extraction of conversation memory at session end without a clear warning, opt-in, or privacy boundary. This is dangerous because it can persist sensitive user data, credentials, or confidential business context beyond the immediate session without informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The display name, summary fields, and nearly all instructional content are presented in Chinese, but the document does not indicate that the skill is region-specific or provide an option for other languages. This can violate language/locale policy expectations when users have not opted into Chinese-only behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

An overly broad invocation phrase makes it unclear when the skill should be activated and what authority it has once invoked. For a skill that can read, write, and execute commands while persisting memory, vague triggering increases the chance of accidental use on inappropriate tasks and unintended data retention.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documented rollback feature can revert the entire memory graph state, but the skill does not clearly warn about data loss, overwriting newer state, or restoring stale/conflicting information. In a persistent memory system, this can silently destroy integrity or undo user-intended updates.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instructions direct the agent to persistently capture and auto-extract conversation content, including user-provided information, without sensitivity limits or minimization. In context, this is especially dangerous because the skill includes write and exec capabilities and is explicitly designed for long-term recall, making overcollection and retention of secrets, personal data, and proprietary information likely.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation gives contradictory storage locations for brain data, alternating between $HOME/.neuralmemory/ and $HOME/.db. In a skill with write and exec capabilities, path confusion can cause data to be written, read, deleted, or restored from the wrong location, increasing risk of accidental disclosure or destructive actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.