Security audit

Memory Semantic Search

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-built for semantic Markdown search, but it needs review because it can upload broad workspace notes and search queries to a configured embedding provider without strong scoping or privacy controls.

Install only if you are comfortable sending the selected Markdown files and each search query to the configured embedding provider. Use a trusted HTTPS or local endpoint, avoid broad workspace roots, do not index secrets or regulated data, and treat the SQLite database as sensitive because it stores plaintext snippets.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/index.py:90
Finding: Unrestricted embedding endpoint can receive sensitive text and bearer credentials
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/index.py:124
Finding: Recursive indexing uploads all visible Markdown without sensitive-data controls
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The documentation directs users to configure a remote API base URL, and the skill’s function inherently sends indexed Markdown content to that endpoint for embedding generation. In this context, the external transmission is expected functionality, but it is still security-relevant because the data may include sensitive workspace notes and the README does not foreground the exfiltration risk.
Content: Scanner excerpt · README.md (reported line 19)May include surrounding context.
bash
export EMBEDDING_API_KEY="your-api-key" export EMBEDDING_API_BASE="https://api.openai.com/v1" # 任何 OpenAI 兼容端点 export EMBEDDING_MODEL="text-embedding-3-small" # 可选，这是默认值

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README explains how to configure and use an external Embedding API but does not explicitly warn that workspace Markdown contents and user search queries will be transmitted off-host to a third-party service. Because this skill is specifically designed to index potentially sensitive notes and memories, users may unknowingly exfiltrate confidential data during indexing and search.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 87% confidence
Finding: The environment variable documentation reinforces use of an external embedding endpoint but does not pair it with a warning about what data leaves the system. Since this skill operates over workspace memory files, that omission can lead to unintentional disclosure of private or confidential content to third-party services.
Content: Scanner excerpt · README.md (reported line 80)May include surrounding context.
md
| 环境变量 | 说明 | |----------|------| | `EMBEDDING_API_KEY` | API Key（必填） | | `EMBEDDING_API_BASE` | API 地址（默认：`https://api.openai.com/v1`） | | `EMBEDDING_MODEL` | 模型名（默认：`text-embedding-3-small`） | | `MSS_DB` | SQLite 数据库路径 | | `MSS_TOP_K` | 搜索返回数量 |

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill documents capabilities that read workspace files, access environment variables for API credentials, and make outbound network requests, but it does not declare any explicit tool scope or permissions. This weakens least-privilege controls and can cause an agent or reviewer to underestimate the skill’s effective access, increasing the chance of unintended data exposure from local markdown content sent to the embedding service.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: The skill is explicitly designed to send workspace markdown content, or chunks derived from it, to an external OpenAI-compatible embedding API. Even though this is core functionality rather than obviously malicious behavior, it creates a real data exfiltration channel for potentially sensitive notes, decisions, or memory files, and the risk is heightened because the endpoint is configurable to any compatible service.
Content: Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.
bash
export EMBEDDING_API_KEY="sk-xxx" export EMBEDDING_API_BASE="https://api.openai.com/v1" # any OpenAI-compatible endpoint export EMBEDDING_MODEL="text-embedding-3-small" # optional, this is the default

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: The hardcoded default base URL points to an external OpenAI-compatible service, making off-host data transmission the default behavior for indexed markdown content. While not malicious by itself, this increases the likelihood of unintentional data exfiltration because users may run the tool without realizing their workspace notes are being sent outside the environment.
Content: Scanner excerpt · scripts/index.py (reported line 19)May include surrounding context.
python
# --- Config --- DEFAULT_MODEL = "text-embedding-3-small" DEFAULT_BASE_URL = "https://api.openai.com/v1" DEFAULT_DB = os.path.join(os.path.dirname(__file__), "..", "memory_search.sqlite") CHUNK_TARGET = 400 # target tokens (~chars * 0.75) CHUNK_OVERLAP = 80

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script sends full markdown chunk contents to an external embedding API, which can disclose sensitive notes, credentials, incident details, or proprietary information stored in the workspace. In this skill’s context, semantic indexing is the intended behavior, but the code provides no explicit consent gate, no warning at transmission time, and no filtering to prevent accidental export of sensitive markdown content.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/search.py (reported line 15)May include surrounding context.
python
import urllib.error DEFAULT_MODEL = "text-embedding-3-small" DEFAULT_BASE_URL = "https://api.openai.com/v1" DEFAULT_DB = os.path.join(os.path.dirname(__file__), "..", "memory_search.sqlite") DEFAULT_TOP_K = 5 DEFAULT_MIN_SCORE = 0.3

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script sends the user's query text to an external embedding API, which creates a real data disclosure risk if users enter sensitive notes, secrets, or internal project details. In this skill's context, semantic search over workspace memory makes that more concerning because queries are likely to reference confidential local content, yet the tool provides no explicit warning or consent step before transmitting data off-host.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The page describes indexing markdown notes via an external embedding API but does not clearly warn users that note contents are transmitted off-device during indexing and query text may also be sent during search. In a memory/note-search skill, those files can contain credentials, personal data, internal discussions, or other sensitive workspace content, so missing disclosure increases the risk of unintended data exfiltration to a third party.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructions and operational documentation are presented entirely in Chinese, which imposes a language requirement on users without any opt-in or stated locale justification. The policy calls for flagging language or locale constraints unless the skill offers a choice or clearly documents why the locale restriction is necessary.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The script reads an API credential from the EMBEDDING_API_KEY environment variable to authenticate outbound requests. Accessing credentials is safety-relevant under this rule, and the file lacks any explanatory comment or user-facing warning beyond an error message when the key is absent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document declares lang="zh-CN", and the visible content is entirely in Chinese, which indicates a fixed language/locale. Under the policy, forcing a specific language without user choice or documented justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.