Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local persistent-memory system, but it directs agents to write user-shared information into long-term files automatically and has inconsistent disclosure about credentials, networking, and execution mode.
Install only if you explicitly want an agent to maintain a long-term local memory store under ~/memory. Review what gets written, avoid storing credentials or sensitive personal data, and consider requiring confirmation before any new memory is saved or before any optional network/API/vector-search feature is enabled.
The activation language is extremely broad, covering generic AI use cases like model calling, dialogue, orchestration, and LLM applications. Overbroad triggers increase the chance the skill is invoked in unrelated contexts, where it may start writing persistent memory or requesting elevated capabilities without the user intending to use this specific memory system.
The capability keyword list is excessively broad and ambiguous, making accidental invocation more likely. In a skill that can write to local storage and retain information across sessions, unintended activation materially increases privacy and integrity risk.
The example encourages creation of complete dossiers on people, including identity, company, relationships, and interaction history, in persistent memory. This normalizes collection of personal data and can lead to privacy violations, profiling concerns, and unauthorized retention of third-party information.
The instructions direct immediate writes to the user's filesystem for long-term persistence without a clear, up-front consent and modification warning at the point of use. This is dangerous because users may disclose sensitive information in normal conversation and have it persisted automatically, creating privacy, compliance, and data-integrity risks.
The skill instructs the agent to persist user-shared information immediately into long-term memory before responding. In a conversational environment, this creates a substantial data-retention risk because sensitive or regulated information can be captured reflexively, stored indefinitely, and later exposed through retrieval, indexing, backups, or sync workflows.
The documentation states that core functionality requires no API key, but later instructs users to configure API keys and credentials. Conflicting requirements around secrets handling are dangerous because they can cause users or agents to provision unnecessary credentials, broadening exposure and making secret collection/storage appear normal for a skill that should not need it.
The skill makes contradictory trust and execution claims: it says there are no network requests, yet elsewhere instructs network connectivity checks and discusses HTTPS/API-based operation. This inconsistency can mislead users and host agents about the skill's true behavior and required privileges, increasing the chance that network-capable execution is allowed without informed consent.
The skill metadata and primary instructional content are presented in Chinese, and the file does not offer an opt-in or alternative language choice. Under the policy, a skill should not impose a specific language or locale unless the constraint is documented and justified or the user is given a choice.
The skill presents itself as Markdown-driven only, while the manifest and body require exec-based file and shell operations. This mismatch can bypass user expectations and policy controls that distinguish passive documentation from active command execution, making the skill more privileged in practice than advertised.
No suspicious patterns detected.
