Security audit

Memory Hamster

Security checks for vulnerabilities and agentic risk

Overview

This is a local memory-management skill, but it asks agents to store conversation-derived information and promote it into persistent behavior files without enough user approval, filtering, or rollback controls.

Install only if you want a Chinese-language local memory system that stores and searches prior work. Do not enable the cron jobs or promote lessons into SOUL.md, AGENTS.md, or TOOLS.md unless you first review the exact files touched, exclude sensitive data, require manual approval for every promoted rule, and have a way to undo changes.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:166
Finding: Conversation-Derived Content Can Be Promoted into Persistent Agent Control Files
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/memory-gc.sh:58
Finding: Archive Processing Breaks on Memory Filenames Containing Whitespace
Content: View full analysis
/dev/null | grep -v "INDEX.md" | grep -v "MEMORY.md" || true) if [ -z "$COLD_FILES" ]; then log_info "没有需要归档的冷数据" ARCHIVED_COUNT=0 else log_info "发现冷数据：" echo "$COLD_FILES" | while read -r file; do if [ -n "$file" ]; then filename=$(basename "$file") echo " - $filename" fi done ARCHIVED_COUNT=$(echo "$COLD_FILES" | grep -c ".md" 2>/dev/null || echo "0") if [ "$DRY_RUN" != "--dry-run" ]; then for file in $COLD_FILES; do if [ -n "$file" ] && [ -f "$file" ]; then filename=$(basename "$file") log_info "归档：$filename → .archive/$CURRENT_MONTH/" mv "$file" "$ARCHIVE_DIR/$CURRENT_MONTH/$filename" fi done log_info "冷数据已归档到：$ARCHIVE_DIR/$CURRENT_MONTH/" else log_warn "DRY RUN: 将归档 $ARCHIVED_COUNT 个文件到 .archive/$CURRENT_MONTH/" fi fi ``` ### Technical Analysis The output of `find` is stored in the scalar variable `COLD_FILES` and later expanded without quotation in: ```bash for file in $COLD_FILES; do ``` Shell word splitting treats spaces, tabs, and newlines as delimiters. Consequently, a valid Markdown filename containing whitespace is divided into multiple path fragments rather than processed as one path. Newline-delimited `find` output also cannot safely represent filenames that themselves contain newlines. Although the subsequent `mv` arguments are quoted, that quoting occurs only after the original path has already been split. The flaw primarily affects availability and integrity of the archive process; the reviewed code does not turn the split filename into a shell command, so arbit ...[truncated 1117 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a broad agent memory/learning system with multiple features: temperature modeling, auto-archiving, learning records, and skill refinement. The supplied code does not implement such a system. It is a Bash script whose sole purpose is to create a new skill folder and populate a SKILL.md template based on a validated skill name. While this loosely relates to the '技能提炼' (skill extraction/refinement) part of the description, it does not implement the broader memory evolution system, nor any temperature model, archiving, or active learning-record processing. There are no suspicious undeclared resource accesses; the main issue is that the actual behavior is materially narrower and different from the declared primary purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: The code does implement parts of the description: temperature modeling (hot/warm/cold classification), automatic archiving of old memory files, and some reporting over structured knowledge folders. However, it does not actually perform '学习记录' in any substantive sense beyond counting files in certain directories, and it does not implement '技能提炼' at all. Its primary behavior is operational maintenance/GC of Markdown memory files, not a full memory evolution system that makes the AI smarter. Therefore the description overstates the implemented capabilities and is only partially accurate.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 86% confidence
Finding: The code does operate in the general memory/reflection domain, but the declared description substantially overstates what it does. The script mainly performs filesystem maintenance and reporting: ensures directories exist, counts files/tasks, creates a boilerplate reflection file, conditionally appends a health-statistics section to INDEX.md, and detects old logs. It does not implement a temperature model, does not automatically archive anything, and does not extract skills or meaningfully learn from content beyond simple grep-based counting. Therefore the declared purpose does not accurately represent the actual behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README advertises automatic archiving and nightly reflection but does not clearly disclose that the skill will create, modify, and retain local memory files on a recurring schedule. In a memory-management skill, silent scheduled writes increase privacy and integrity risk because users may enable cron jobs without understanding ongoing data collection and file mutation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README promotes semantic search over memory without clearly warning that stored user history, preferences, and prior interactions may be indexed or queried. For a tool centered on persistent memory, this omission can mislead users about the scope of personal data processing and increase unintended exposure of sensitive historical context.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: The README instructs users to install cron jobs that run indefinitely and persistently modify local state, which creates ongoing session persistence behavior outside the immediate user interaction. In the context of a memory skill, persistent background execution is more sensitive because it continually processes and archives conversational memory, increasing privacy, retention, and tampering risks if not clearly bounded and disclosed.
Content: Scanner excerpt · README.md (reported line 58)May include surrounding context.
bash
# 编辑 crontab crontab -e # 添加以下任务 0 0 * * 0 /path/to/skills/memory-hamster/scripts/memory-gc.sh >> /path/to/logs/memory-gc.log 2>&1

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill description and most instructions are presented in Chinese, which can impose a language preference on users without opt-in. The policy requires either offering a language/locale choice or clearly documenting that the skill is intended for a specific locale or audience.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill advertises automatic archiving and record creation that modify workspace files, but it does not prominently warn users that installation and scheduled execution will persistently alter memory and log data. In an agent setting, silent background modification increases the chance of unintended retention, overwrites, or archival of sensitive information without informed consent.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 89% confidence
Finding: The skill instructs users to install persistent cron jobs that run unattended and continue modifying/logging data outside the immediate session. In this context, persistence amplifies the privacy and integrity risks of the skill because archival and reflection processes will keep operating even when the user may not be actively supervising or remembering that retention is enabled.
Content: Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.
bash
# 编辑 crontab crontab -e # 添加以下任务（根据实际安装路径调整） 0 0 * * 0 ./skills/memory-hamster/scripts/memory-gc.sh >> ./logs/memory-gc.log 2>&1

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: These instructions tell the agent to persist user-provided information, decisions, corrections, and daily activity across sessions in multiple memory files. Without data-minimization rules, consent controls, or sensitivity filtering, this can create long-lived storage of personal, confidential, or regulated information that later tools, users, or processes may access.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The templates explicitly instruct logging full context, user needs, errors, and related files into persistent records. That creates a clear pathway for sensitive prompts, file paths, credentials, proprietary code details, or personal data to be stored indefinitely and later surfaced by search or skill-extraction workflows.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This shell script includes its user-facing description and runtime messages in Chinese, and there is no indication that the skill is region-specific or that users may opt into another language. The policy for natural-language violations applies to all file types, so hard-coding a single language without opt-in is a reportable locale-policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script’s comments and all user-visible messages are written in Chinese, including usage/help context and runtime status output. For a general-purpose skill, this imposes a specific language on users without opt-in or an explicit justification that the skill is intended only for a Chinese-speaking or region-specific environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown template uses Chinese-only instructional text for key sections such as the summary, error, context, and suggested fix. That imposes a specific language/locale in the skill artifact without offering a user choice or documenting that the template is intended only for a Chinese-language context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The template’s instructional text for Summary, Details, and Suggested Action is written only in Chinese, which implicitly requires lessons to be authored in that language. This is a natural-language locale constraint without any opt-in, alternative language guidance, or documented region-specific justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The natural-language instructions and descriptions are written in Chinese throughout the file, which effectively imposes a language requirement on users without an explicit opt-in or justification. Under the stated policy, a skill should offer language choice or document why a specific locale is required.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: L324 将提取脚本写成 ./skills/vv-evolution/scripts/extract-skill.sh，但本文件前文多处将该能力明确归属于当前技能 memory-hamster，实际目录结构也在 L125-L131 列出为 skills/memory-hamster/scripts/extract-skill.sh。这不是单纯遗漏信息，而是文档直接指向另一个技能路径，与本技能说明发生明显冲突。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The natural-language description is written entirely in Chinese, which can impose a specific language on users without any opt-in or indication that the skill is intended only for a Chinese-speaking or region-specific audience. This matches the policy concern about language or locale constraints that are not optional or justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The header comments and usage examples indicate the tool is intended for Chinese-language interaction, and the runtime messages later in the file are also exclusively in Chinese. This creates a natural-language locale constraint without user opt-in or justification that the skill is region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The entire template, including the title and section labels, is written in Chinese and does not offer any language choice or explain that it is intended only for a Chinese-speaking context. This can violate a language/locale policy when skills are expected to avoid forcing a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The template contains fixed Chinese prompt text for multiple sections, which imposes a specific language on users filling out the feature request. This is a natural-language locale policy issue because the file does not indicate that Chinese is optional or provide any user language choice.
Content: No source excerpt is available for this finding.