Security audit

Evomind

Security checks for vulnerabilities and agentic risk

Overview

This is a local persistent memory tool whose main risks are expected for its purpose, mainly storing user-provided text and skill content on disk.

Install only if you want a local long-lived memory database for agent facts and saved skill text. Do not store API keys, passwords, private customer data, or proprietary files unless you are comfortable with them being retained in ~/.agent_memory.db; review and delete stored entries when needed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The description markets the skill as a full 'Agent evolution operating system' with 'five-layer memory × self-evolution engine' and says it is directly installable/runnable. The supplied code is indeed runnable and is consistent with a memory-related CLI, so part of the claim is supported. However, the code shown mainly provides a CLI wrapper around MemoryCore for remembering, forgetting, recalling, skill save/load/list/find/delete, curation, stats, and health checks. There is no clear evidence in this chunk of a self-evolution engine or broader operating-system-like behavior. While some five-layer references appear in help text and health output, the concrete exposed operations are primarily memory and skill management. Therefore the declared purpose overstates the actual demonstrated behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly promotes cross-session persistent memory and saving skill contents, yet provides no warning or guidance about storing secrets, tokens, personal data, or proprietary material. In an agent context, persistent memory materially increases the chance of long-term retention, later retrieval, and unintended disclosure of sensitive information across sessions or workflows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill-delete branch deletes stored skill data and only prints success or failure after the operation. Unlike forget-all, it provides no pre-action confirmation, warning, or explanatory comment/docstring to disclose that the action is destructive.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code implements a persistent memory system that stores user facts, session cache values, and full skill content in a local SQLite database, but the class and method documentation do not clearly warn that these inputs are retained on disk. Because the stored content may include sensitive user or system data, the absence of an explicit disclosure is a safety-relevant omission for a code file handling file writes and durable retention.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The forget, forget_all, and related deletion paths permanently remove stored entries, but these methods provide no confirmation prompt, logging, or cautionary comment indicating the destructive nature of the action. For code files, irreversible operations should have some visible disclosure unless already clearly warned elsewhere, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The natural-language description, tags, and the rest of the file present the skill entirely in Chinese, with no indication that users may choose another language or that the locale restriction is intentional and justified. This can constitute a language/locale policy issue when a skill implicitly forces one language without opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: L16 says '零外部依赖，仅标准库' but instructs users to run 'pip install -r requirements.txt', implying package-managed dependencies beyond a pure standard-library-only usage path. This is an intent/documentation contradiction within the skill documentation itself, even though no executable code is shown in this file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The health command prints 五层全通 and 存在异常 unconditionally, which imposes a specific language on all users. There is no visible opt-in, locale selection, or documentation that this CLI is intentionally Chinese-only or region-specific.
Content: No source excerpt is available for this finding.