Security audit

持久记忆引擎

Security checks across malware telemetry and agentic risk

Overview

This is a local persistent-memory skill, but it can store broad conversational and people-related information durably without a clear per-entry consent gate and its API/network guidance is inconsistent.

Review before installing. Use it only if you want an agent to create durable local records under ~/memory, and set a rule that nothing is saved unless you explicitly approve the exact content. Avoid storing credentials, sensitive personal data, or third-party profiles, and disable or ignore optional API/network features unless you intentionally configure them.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The documentation makes contradictory claims about network behavior: it says the skill performs no network requests, yet elsewhere instructs running ping/network diagnostics and describes HTTPS/API-based operations. This inconsistency can mislead users and host agents about the skill’s true trust boundary, increasing the chance of unintended network access or policy bypass.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The skill states core functionality requires no API key, but later sections instruct users to configure API keys and establish API connections. This discrepancy can cause accidental credential collection or misuse because users may disclose secrets under the assumption that the skill is local and self-contained.

Vague Triggers

High

Confidence: 96% confidence
Finding: The activation scope is extremely broad, covering generic AI model calls, conversations, orchestration, and LLM applications. Overbroad triggers can cause the skill to activate in unrelated contexts and gain opportunities to read, write, or execute actions when not actually needed.

Vague Triggers

High

Confidence: 95% confidence
Finding: The capability keyword list is expansive, vague, and overlaps with many normal assistant tasks. Ambiguous routing increases the chance that ordinary conversation gets treated as a memory-storage workflow, leading to unintended persistence of user data or unnecessary command execution.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill instructs immediate writes of user-shared information into persistent local storage before responding, without a clear consent gate or prominent warning. This is dangerous because users may reveal personal, project, or preference data in normal conversation without realizing it will be durably stored on disk.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The workflow directs the agent to persist user-shared information immediately into long-term memory files before responding. In context, this affects potentially sensitive personal, professional, and preference data, creating durable records without meaningful review or minimization.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The example explicitly encourages building persistent dossiers on people from conversational inputs, including names, companies, relationships, and interaction history. This raises privacy and profiling risks, especially if the data concerns third parties who did not consent to being stored.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to ask what the user wants to store and then create persistent categories to capture it, enabling broad collection of user data. In a memory skill, that context makes the issue more dangerous because the design goal is durable accumulation across sessions, which magnifies privacy impact over time.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.