Security audit
Security checks for vulnerabilities and agentic risk
The skill’s memory-storage purpose is coherent, but it needs Review because it tells agents to run shell commands with user-provided memory text and creates persistent credentials for off-device storage.
Install only if you are comfortable with encrypted memories being stored off-device and persistent credentials being created on this machine. Before using it, require safe memory-cli invocation that never passes remembered text through a shell command string, and check how credentials can be revoked or deleted.
SKILL.md:194Shell Command Injection Through Unsafely Interpolated Memory Content
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
│ │ 安全协议 (SECURITY) │ │
│ │ - 恢复短语永不进入对话上下文 │ │
│ │ - 凭据文件Agent永不读取 │ │
│ │ - 安装/重装时不检查credentials.json │ │
│ │ - 短语泄露即视为妥协，必须重新配对 │ │
│ └──────────────────────────────────────────────────┘ │
│ │
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
│ │ 安全协议 (SECURITY) │ │
│ │ - 恢复短语永不进入对话上下文 │ │
│ │ - 凭据文件Agent永不读取 │ │
│ │ - 安装/重装时不检查credentials.json │ │
│ │ - 短语泄露即视为妥协，必须重新配对 │ │
│ └──────────────────────────────────────────────────┘ │
│ │
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
│ │ 安全协议 (SECURITY) │ │
│ │ - 恢复短语永不进入对话上下文 │ │
│ │ - 凭据文件Agent永不读取 │ │
│ │ - 安装/重装时不检查credentials.json │ │
│ │ - 短语泄露即视为妥协，必须重新配对 │ │
│ └──────────────────────────────────────────────────┘ │
│ │
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
│ │ 安全协议 (SECURITY) │ │
│ │ - 恢复短语永不进入对话上下文 │ │
│ │ - 凭据文件Agent永不读取 │ │
│ │ - 安装/重装时不检查credentials.json │ │
│ │ - 短语泄露即视为妥协，必须重新配对 │ │
│ └──────────────────────────────────────────────────┘ │
│ │
This line documents that pairing automatically writes a credentials file to a known path, creating persistent secret material on disk. While the skill says the agent must not read it, the creation of credentials without an emphasized warning increases the chance of accidental exposure, backup leakage, or subsequent misuse by other tools on the host.
- 短语在浏览器端加密后上传，**永不进入本对话**
3. **确认配对完成**：
- 配对完成后，凭据文件自动写入 `~/.total-recall-ai/credentials.json`
- Agent确认："全息记忆AI已配对完成。"
**重要**：配对是无条件的——用户主动安装/请求配对本身就是同意，不需要二次确认门。
The skill instructs the agent to upload encrypted memory data to a decentralized network, but the data egress warning is not made sufficiently explicit at the point of use. Even if encrypted, sending sensitive user facts off-device is a material privacy and compliance concern that users should affirmatively understand before use.
The pairing flow causes a local system change by automatically writing a credentials file, but the skill does not present this as a prominent pre-action warning. In an agent context, understated side effects can lead users to authorize operations without fully understanding that persistent authentication material will be created on disk.
该文件明确将作品特性描述为“完全中文化表达”，整体指令与交互示例也默认固定为中文，未说明用户可选择其他语言。这构成语言/locale 约束，但文档中没有用户 opt-in，也没有给出仅适用于特定中文地区场景的必要性说明。
L380-L384 明确写免费版“不支持多设备间记忆同步”，且仅支持“基础关键词检索”。但同一文件 earlier 在 L003/L025/L091/L138-L149 将其描述为去中心化网络中的跨会话持久化记忆，并在 L090 给出 last_sync 状态、L165 写 memory_search 为“语义搜索记忆”。这些说明对免费版实际能力边界相互矛盾，会误导开发者对该 skill 的真实行为与保障作出错误判断。