Quick Context Saver Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.0

Overview

This local memory skill has a coherent purpose, but it asks users to install an unpinned global npm package and persist broad conversation memory in plaintext by default.

Install only if you are comfortable with a global npm CLI and plaintext local memory files in each project. Review the npm package source and version before installing, avoid storing credentials or regulated data, add generated memory files to ignore/backup rules as appropriate, and periodically inspect or delete stored memories.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:64

Finding

Unpinned Global Installation of an External npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 64 and 406
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: High

Vulnerable Code Snippet

bash

npm install -g quick-context-saver

The dependency table repeats the same global installation command:

text

| quick-context-saver | npm package | Required | `npm install -g quick-context-saver` |

Technical Analysis

The Skill requires users to retrieve and globally install quick-context-saver from the npm registry. The dependency is not pinned to an exact version, and the project provides no lockfile, integrity hash, bundled implementation, package provenance, or publisher-verification procedure.

Consequently, the code reviewed in this project does not determine the code that will execute. npm resolves the package version and contents at installation time. A compromised publisher account, malicious replacement release, dependency compromise, or future unsafe update could introduce arbitrary JavaScript. npm lifecycle scripts can also execute during installation under the privileges of the user running npm.

The global -g installation increases exposure by placing executable commands into the user's global npm environment. The package's claimed local-only and zero-external-dependency behavior cannot be verified because its implementation is absent from the audited project.

Attack Path

1. An attacker compromises the npm package, its publisher account, or one of its transitive dependencies.
2. The attacker publishes a malicious version containing an installation lifecycle script or modified CLI implementation.
3. A user follows the Skill instructions and runs npm install -g quick-context-saver.
4. npm resolves the mutable package version and downloads the attacker-controlled content.
5. Malicious lifecycle code executes during installation, or malicious behavior executes when a memory-* com ...[truncated 846 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed, immutable version rather than installing the latest release.
2. Record and verify the package integrity hash before installation.
3. Include a lockfile and publish verifiable npm provenance or signed release artifacts.
4. Bundle the auditable implementation with the Skill where licensing permits.
5. Avoid global installation; use a project-local dependency with a narrowly scoped execution command.
6. Disable npm lifecycle scripts during installation where compatible, and explicitly audit any scripts that must run.
7. Document the expected npm publisher identity, package checksum, source repository, and verification procedure.
8. Execute the CLI with least privilege in a sandbox that restricts filesystem and network access.
9. Audit the package and its complete transitive dependency tree before recommending it as required software.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:96

Finding

Sensitive Agent Memory Persisted in Unencrypted Local Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 96-105 and 382-390
Vulnerability Type: Plaintext persistence of potentially sensitive conversational data
Risk Level: Medium

Vulnerable Code Snippet

The following is an English rendering of the persistence instructions at lines 96-105:

markdown

## Local Memory Usage Rules

When the user provides important information:
1. First write it to SESSION-STATE.json
2. Then store it using memory-store
3. Finally respond to the user

At the beginning of a session:
1. Read SESSION-STATE.json
2. Search related memories using memory-search
3. Check MEMORY.md for context

The storage description at line 382 states that all memories are stored in JSON files under memories/, active memory is stored in SESSION-STATE.json, and long-term memory is stored in MEMORY.md.

The known-limitations statement at line 390 explicitly states that the free version does not support encrypted storage.

Technical Analysis

The Skill directs the Agent to persist preferences, decisions, facts, deadlines, lessons, and contextual information before responding to the user. It subsequently reloads that data at the beginning of later sessions. These records are stored in plaintext JSON and Markdown files, while encryption is explicitly unsupported.

The instructions do not require informed user consent before persistence, secret detection, data minimization, restrictive file permissions, repository exclusion, retention limits, or automatic deletion. They also do not establish a trust boundary between recalled data and executable Agent instructions.

Local storage prevents direct cloud transmission, but it does not by itself provide confidentiality. Plaintext files may be readable by other local processes or users, collected by backup and indexing software, included in shared archives, or accidentally committed to version control. A compromised dependency executed thro ...[truncated 1915 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user opt-in before enabling persistent memory and before storing sensitive categories.
2. Never persist passwords, API keys, access tokens, private keys, authentication cookies, or other credentials.
3. Add secret detection and redaction before writing content to disk.
4. Encrypt memory files at rest using a key held outside the project directory and protected by the operating system's credential store.
5. Create files and directories with restrictive permissions appropriate to each supported operating system.
6. Automatically add memory files and backup exports to .gitignore and equivalent tooling exclusions.
7. Implement configurable retention periods, expiration, selective deletion, and secure memory reset operations.
8. Present the exact proposed memory content to the user and obtain confirmation before persistence.
9. Treat recalled memory as untrusted data, clearly separate it from system instructions, and prevent stored text from changing tool permissions or safety rules.
10. Document the exposure risks associated with backups, shared workspaces, device theft, search indexing, and repository commits.
11. Minimize collected data and store structured summaries rather than complete sensitive conversation content.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill directs the agent to persist user information into local files by default, but provides no consent flow, sensitivity checks, or warning that secrets and personal data may be retained on disk. This creates a privacy and data-handling risk because users may disclose credentials, personal details, or regulated data during normal conversation and have it silently stored in plaintext.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill encourages broad default retention of user-provided preferences, decisions, deadlines, and corrections in natural language, creating a systematic privacy risk. Because the instructions are generic and automatic, the agent may capture far more sensitive context than necessary, increasing exposure through local compromise, backups, logs, or accidental sharing of workspace files.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The WAL protocol explicitly requires saving several classes of user input before replying, which operationalizes always-on persistence as a default behavior. In the context of an agent skill, this is more dangerous because normal conversational corrections, plans, and deadlines often contain personal, business-confidential, or security-relevant details, and the skill stores them without contextual safeguards.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest and repeated documentation state that the skill is '零外部依赖、零网络请求' and fully local, yet the dependency section requires obtaining quick-context-saver via npm and lists an external runtime dependency. That means the skill is not truly zero-dependency in practice, and its setup/use path is inconsistent with the claimed purely local, no-external-dependency positioning.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The text explicitly states 完全中文化表达，适配中文用户工作流, which indicates a forced language/locale orientation. There is no accompanying opt-in, multilingual option, or clear justification that this skill is restricted to a Chinese-only regulatory or regional context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The API key/configuration section explicitly says all memory operations are local and involve zero network requests, which frames the skill as offline-only. The later '网络错误' row introduces network diagnostics and retry guidance, contradicting the stated operational model and suggesting network-dependent behavior despite the earlier claims.

Content

No source excerpt is available for this finding.