Security audit

持久记忆引擎

Security checks across malware telemetry and agentic risk

Overview

This is a local persistent-memory skill, but its instructions mix automatic long-term file changes with unclear network, API key, and data-retention guidance that users should review carefully.

Install only if you want an agent to keep a long-term local memory folder and mutate it over time. Before use, decide what categories may be stored, avoid secrets or sensitive personal data, require confirmation before syncing built-in memory or deleting/archiving entries, and ignore or remove the inconsistent API-key, callback, and network setup guidance unless you intentionally enable an optional external service.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

High

Confidence: 94% confidence
Finding: The skill claims it makes no network requests, yet elsewhere instructs network connectivity testing and discusses API/network operations. This kind of contradictory documentation can mislead users and agents into permitting unexpected outbound activity, weakening trust boundaries and potentially enabling unintended data exposure if future executions rely on those instructions.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The document states core functionality does not require an API key, but later instructs users to configure API keys and establish API connections as part of normal setup. Inconsistent credential requirements can trick users into supplying secrets unnecessarily, increasing the chance of accidental key exposure or overly broad trust in the skill's data flows.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The skill strongly claims isolation to ~/memory/ and non-interference with built-in memory, but later permits reading built-in memory for one-way sync. Even read-only exceptions matter because they expand the data-access boundary and can surprise users who believed the skill was fully segregated from internal memory sources.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill performs persistent writes, archival moves, and eventual deletion of memory files, but the warning to users is not prominent before these actions are introduced. Silent or under-disclosed data modification is dangerous because users may not realize the agent is retaining, reorganizing, or deleting local information over time.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill includes shell command examples and filesystem-affecting maintenance behavior without consistently warning that an agent may execute local commands and alter files. This increases the risk of users approving the skill without understanding that it can create directories, write indexes, move files, and potentially trigger destructive maintenance workflows.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.