Memory Hamster

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:46 AM UTC
• Version: 1.0.1

Overview

This is a local memory-management skill, but it asks agents to store conversation-derived information and promote it into persistent behavior files without enough user approval, filtering, or rollback controls.

Install only if you want a Chinese-language local memory system that stores and searches prior work. Do not enable the cron jobs or promote lessons into SOUL.md, AGENTS.md, or TOOLS.md unless you first review the exact files touched, exclude sensitive data, require manual approval for every promoted rule, and have a way to undo changes.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:166
• Finding: Conversation-Derived Content Can Be Promoted into Persistent Agent Control Files<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:99-103`, `SKILL.md:166-176`, `SKILL.md:277-305`, `SKILL.md:380` **Vulnerability Type**: Persistent memory poisoning through insufficiently controlled promotion **Risk Level**: Medium ### Vulnerable Code ```markdown | 学习类型 | 提升到 | 示例 | |----------|--------|------| | 行为模式 | `SOUL.md` | "简洁回复，不说废话" | | 工作流改进 | `AGENTS.md` | "长任务 spawning 子代理" | | 工具技巧 | `TOOLS.md` | "Git push 需要先配置 auth" | ``` ```markdown **会话中：** - 重要决策 → `memory/decisions/` - 犯错/教训 → `.learnings/LEARNINGS.md` 或 `ERRORS.md` - 用户纠正 → `.learnings/LEARNINGS.md` (category: correction) - 发现更好方法 → `.learnings/LEARNINGS.md` (category: best_practice) ``` ```markdown ### 如何 Promotion 1. **提炼** 学习成简洁的规则或事实 2. **添加** 到目标文件的相关部分 3. **更新** 原始条目： - 改 `**Status**: pending` → `**Status**: promoted` - 添加 `**Promoted**: SOUL.md` 或 `AGENTS.md` 或 `TOOLS.md` ``` ```markdown 7. **积极 Promotion** - 有疑问就提升到配置文件 ``` ### Technical Analysis The Skill instructs the Agent to record user corrections and conversation-derived lessons in `.learnings/LEARNINGS.md`, and later promotes selected content into `SOUL.md`, `AGENTS.md`, or `TOOLS.md`. These target files can influence persistent Agent behavior, workflows, and tool usage across later sessions. The documented promotion process does not require trusted-user approval, source validation, security review, content sanitization, or a preview of the resulting configuration changes. The recommendation to promote content when uncertain further weakens the trust boundary. Because conversation content may be attacker-controlled, an attacker can phrase malicious operational instructions as corrections, best practices, or reusable lessons. If the Agent subsequently promotes those instructions, they can survive beyond the originating session and influence future behavior. The scripts do not directly automate these promotions, so exploitation depends on the Agent following the documented workflow. Nevertheless, ...[truncated 1326 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit approval from a trusted user before writing promoted content to `SOUL.md`, `AGENTS.md`, or `TOOLS.md`. 2. Treat all conversation-derived learning entries as untrusted data rather than executable instructions. 3. Record provenance for every learning entry, including the originating user, session, timestamp, and whether the source was authenticated. 4. Display a complete proposed diff before promotion and require confirmation for each target file. 5. Reject or quarantine entries containing: - Instruction-priority overrides. - Requests to ignore safety constraints. - Shell commands or executable code. - External URLs or payload retrieval instructions. - Credential-handling directives. - Requests to weaken approval or access controls. 6. Replace “promote when uncertain” with a conservative policy that prohibits promotion when trust or intent is uncertain. 7. Restrict promotion to concise, declarative facts or preferences and prohibit autonomous promotion of tool-execution rules. 8. Maintain an auditable promotion log and provide a straightforward rollback mechanism. 9. Where supported, enforce schema validation and allowlisted sections for persistent configuration changes. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/memory-gc.sh:58
• Finding: Archive Processing Breaks on Memory Filenames Containing Whitespace<![CDATA[ ## Vulnerability Details **File Location**: `scripts/memory-gc.sh:58-82` **Vulnerability Type**: Unsafe shell word splitting during scheduled file processing **Risk Level**: Low ### Vulnerable Code ```bash COLD_FILES=$(find "$MEMORY_DIR" -maxdepth 1 -name "*.md" -type f -mtime +30 2>/dev/null | grep -v "INDEX.md" | grep -v "MEMORY.md" || true) if [ -z "$COLD_FILES" ]; then log_info "没有需要归档的冷数据" ARCHIVED_COUNT=0 else log_info "发现冷数据：" echo "$COLD_FILES" | while read -r file; do if [ -n "$file" ]; then filename=$(basename "$file") echo " - $filename" fi done ARCHIVED_COUNT=$(echo "$COLD_FILES" | grep -c ".md" 2>/dev/null || echo "0") if [ "$DRY_RUN" != "--dry-run" ]; then for file in $COLD_FILES; do if [ -n "$file" ] && [ -f "$file" ]; then filename=$(basename "$file") log_info "归档：$filename → .archive/$CURRENT_MONTH/" mv "$file" "$ARCHIVE_DIR/$CURRENT_MONTH/$filename" fi done log_info "冷数据已归档到：$ARCHIVE_DIR/$CURRENT_MONTH/" else log_warn "DRY RUN: 将归档 $ARCHIVED_COUNT 个文件到 .archive/$CURRENT_MONTH/" fi fi ``` ### Technical Analysis The output of `find` is stored in the scalar variable `COLD_FILES` and later expanded without quotation in: ```bash for file in $COLD_FILES; do ``` Shell word splitting treats spaces, tabs, and newlines as delimiters. Consequently, a valid Markdown filename containing whitespace is divided into multiple path fragments rather than processed as one path. Newline-delimited `find` output also cannot safely represent filenames that themselves contain newlines. Although the subsequent `mv` arguments are quoted, that quoting occurs only after the original path has already been split. The flaw primarily affects availability and integrity of the archive process; the reviewed code does not turn the split filename into a shell command, so arbit ...[truncated 1117 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Use null-delimited file traversal and process each pathname without storing the full result in a scalar shell variable: ```bash ARCHIVED_COUNT=0 while IFS= read -r -d '' file; do filename=$(basename -- "$file") log_info "Archiving: $filename → .archive/$CURRENT_MONTH/" mv -- "$file" "$ARCHIVE_DIR/$CURRENT_MONTH/$filename" ARCHIVED_COUNT=$((ARCHIVED_COUNT + 1)) done < <( find "$MEMORY_DIR" \ -maxdepth 1 \ -type f \ -name '*.md' \ -mtime +30 \ ! -name 'INDEX.md' \ ! -name 'MEMORY.md' \ -print0 ) ``` Additional hardening should include: 1. Use `--` before path arguments passed to commands such as `mv` and `basename`. 2. Avoid parsing `find` output through `grep`; express exclusions directly with `find` predicates. 3. Define collision behavior when an archive file with the same name already exists. 4. Check and report individual move failures rather than relying solely on global `set -e`. 5. Add tests covering filenames with spaces, tabs, leading hyphens, Unicode characters, and newlines. 6. Run `--dry-run` before enabling the weekly cron job and ensure cron uses an explicit, trusted `WORKSPACE` value. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a broad agent memory/learning system with multiple features: temperature modeling, auto-archiving, learning records, and skill refinement. The supplied code does not implement such a system. It is a Bash script whose sole purpose is to create a new skill folder and populate a SKILL.md template based on a validated skill name. While this loosely relates to the '技能提炼' (skill extraction/refinement) part of the description, it does not implement the broader memory evolution system, nor any temperature model, archiving, or active learning-record processing. There are no suspicious undeclared resource accesses; the main issue is that the actual behavior is materially narrower and different from the declared primary purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: The code does implement parts of the description: temperature modeling (hot/warm/cold classification), automatic archiving of old memory files, and some reporting over structured knowledge folders. However, it does not actually perform '学习记录' in any substantive sense beyond counting files in certain directories, and it does not implement '技能提炼' at all. Its primary behavior is operational maintenance/GC of Markdown memory files, not a full memory evolution system that makes the AI smarter. Therefore the description overstates the implemented capabilities and is only partially accurate.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 86% confidence
• Finding: The code does operate in the general memory/reflection domain, but the declared description substantially overstates what it does. The script mainly performs filesystem maintenance and reporting: ensures directories exist, counts files/tasks, creates a boilerplate reflection file, conditionally appends a health-statistics section to INDEX.md, and detects old logs. It does not implement a temperature model, does not automatically archive anything, and does not extract skills or meaningfully learn from content beyond simple grep-based counting. Therefore the declared purpose does not accurately represent the actual behavior.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README advertises automatic archiving and nightly reflection but does not clearly disclose that the skill will create, modify, and retain local memory files on a recurring schedule. In a memory-management skill, silent scheduled writes increase privacy and integrity risk because users may enable cron jobs without understanding ongoing data collection and file mutation.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README promotes semantic search over memory without clearly warning that stored user history, preferences, and prior interactions may be indexed or queried. For a tool centered on persistent memory, this omission can mislead users about the scope of personal data processing and increase unintended exposure of sensitive historical context.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# 编辑 crontab
crontab -e

# 添加以下任务
0 0 * * 0 /path/to/skills/memory-hamster/scripts/memory-gc.sh >> /path/to/logs/memory-gc.log 2>&1

• Confidence: 85% confidence
• Finding: The README instructs users to install cron jobs that run indefinitely and persistently modify local state, which creates ongoing session persistence behavior outside the immediate user interaction. In the context of a memory skill, persistent background execution is more sensitive because it continually processes and archives conversational memory, increasing privacy, retention, and tampering risks if not clearly bounded and disclosed.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The skill description and most instructions are presented in Chinese, which can impose a language preference on users without opt-in. The policy requires either offering a language/locale choice or clearly documenting that the skill is intended for a specific locale or audience.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill advertises automatic archiving and record creation that modify workspace files, but it does not prominently warn users that installation and scheduled execution will persistently alter memory and log data. In an agent setting, silent background modification increases the chance of unintended retention, overwrites, or archival of sensitive information without informed consent.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# 编辑 crontab
crontab -e

# 添加以下任务（根据实际安装路径调整）
0 0 * * 0 ./skills/memory-hamster/scripts/memory-gc.sh >> ./logs/memory-gc.log 2>&1

• Confidence: 89% confidence
• Finding: The skill instructs users to install persistent cron jobs that run unattended and continue modifying/logging data outside the immediate session. In this context, persistence amplifies the privacy and integrity risks of the skill because archival and reflection processes will keep operating even when the user may not be actively supervising or remembering that retention is enabled.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: These instructions tell the agent to persist user-provided information, decisions, corrections, and daily activity across sessions in multiple memory files. Without data-minimization rules, consent controls, or sensitivity filtering, this can create long-lived storage of personal, confidential, or regulated information that later tools, users, or processes may access.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The templates explicitly instruct logging full context, user needs, errors, and related files into persistent records. That creates a clear pathway for sensitive prompts, file paths, credentials, proprietary code details, or personal data to be stored indefinitely and later surfaced by search or skill-extraction workflows.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This shell script includes its user-facing description and runtime messages in Chinese, and there is no indication that the skill is region-specific or that users may opt into another language. The policy for natural-language violations applies to all file types, so hard-coding a single language without opt-in is a reportable locale-policy issue.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The script’s comments and all user-visible messages are written in Chinese, including usage/help context and runtime status output. For a general-purpose skill, this imposes a specific language on users without opt-in or an explicit justification that the skill is intended only for a Chinese-speaking or region-specific environment.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This markdown template uses Chinese-only instructional text for key sections such as the summary, error, context, and suggested fix. That imposes a specific language/locale in the skill artifact without offering a user choice or documenting that the template is intended only for a Chinese-language context.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The template’s instructional text for Summary, Details, and Suggested Action is written only in Chinese, which implicitly requires lessons to be authored in that language. This is a natural-language locale constraint without any opt-in, alternative language guidance, or documented region-specific justification.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The natural-language instructions and descriptions are written in Chinese throughout the file, which effectively imposes a language requirement on users without an explicit opt-in or justification. Under the stated policy, a skill should offer language choice or document why a specific locale is required.

Intent-Code Divergence

Low

• Confidence: 96% confidence
• Finding: L324 将提取脚本写成 `./skills/vv-evolution/scripts/extract-skill.sh`，但本文件前文多处将该能力明确归属于当前技能 `memory-hamster`，实际目录结构也在 L125-L131 列出为 `skills/memory-hamster/scripts/extract-skill.sh`。这不是单纯遗漏信息，而是文档直接指向另一个技能路径，与本技能说明发生明显冲突。

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The natural-language description is written entirely in Chinese, which can impose a specific language on users without any opt-in or indication that the skill is intended only for a Chinese-speaking or region-specific audience. This matches the policy concern about language or locale constraints that are not optional or justified.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The header comments and usage examples indicate the tool is intended for Chinese-language interaction, and the runtime messages later in the file are also exclusively in Chinese. This creates a natural-language locale constraint without user opt-in or justification that the skill is region-specific.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: The entire template, including the title and section labels, is written in Chinese and does not offer any language choice or explain that it is intended only for a Chinese-speaking context. This can violate a language/locale policy when skills are expected to avoid forcing a specific language without user opt-in.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The template contains fixed Chinese prompt text for multiple sections, which imposes a specific language on users filling out the feature request. This is a natural-language locale policy issue because the file does not indicate that Chinese is optional or provide any user language choice.

Static analysis

No suspicious patterns detected.