Xiaoshan Memory Publish

• Outcome: Review
• Latest audit: May 28, 2026 · 11:29 AM UTC
• Version: 3.3.0

Overview

This is a coherent memory skill, but its remote install/update source and persistent credential/data handling need careful review before use.

Use this only if you are comfortable with a memory tool that stores local state and may send memory-related content to configured AI providers. Verify the remote update source before installing, avoid storing secrets or regulated data, prefer local-provider mode for sensitive use, and require explicit confirmation for save and forget/delete actions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence
• Finding: The skill description frames the feature set as memory/search functionality, but the reported behavior includes activation key storage, installation checks, and local status probing of files like activation.json and memory.db. That mismatch is security-relevant because users may grant trust to a memory skill without realizing it also inspects environment state and local filesystem artifacts; the 'skill is safe' language in the file further increases suspicion rather than reducing it.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The manifest for a memory-management skill includes an external update URL that downloads code, which expands the trust boundary beyond the declared functionality. Because the URL points to a non-platform-controlled host, the skill could later fetch modified code without transparent review, enabling supply-chain compromise or hidden capability changes.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: Using plain HTTP for an update source allows an attacker on the network path to tamper with the downloaded package or redirect the client to malicious content. In a skill that handles persistent memory, a compromised update could expose stored data, alter recall behavior, or introduce arbitrary malicious logic under the guise of a normal memory feature.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The README documents persistent storage and deletion-related endpoints but does not warn users that submitted content may be stored long-term, indexed for semantic search, and affected by deletion semantics that may not fully remove derived data such as embeddings or graph links. In a memory engine, that omission can cause users to send sensitive data under incomplete assumptions about retention and deletion, creating privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The provider list names third-party AI services but does not disclose that memory contents, queries, or derived embeddings may be transmitted to those providers depending on configuration. Because this skill is specifically designed to store and search persistent memories, users may unknowingly expose sensitive personal or proprietary information to external processors.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation exposes a destructive `/forget` capability but does not warn users that it permanently deletes stored memory or describe confirmation, scope, or recovery expectations. In a persistent memory skill, this increases the chance of accidental or overly broad deletion, especially when triggered through natural-language agent actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill is explicitly marketed as persistent AI memory with semantic search and knowledge graph features, but it does not disclose privacy, retention, or sensitivity risks around storing user data long term. This can lead users or integrating agents to submit secrets, personal data, or regulated information without informed consent or handling guidance.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: Using a generic trigger like 'remember' creates a substantial risk of accidental activation during ordinary conversation, which is especially dangerous for a persistent-memory skill because it can silently store user content. In this context, broad activation increases the chance of collecting sensitive data without sufficiently explicit user intent.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger 'forget' is also common conversational language and could unintentionally activate deletion functionality. In a skill that exposes persistent memory operations, accidental destructive activation can lead to unintended data loss or manipulation of the memory store.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The decision guide advertises deletion behavior ('POST /forget', 'Delete that memory / 删除记忆') without an accompanying warning, confirmation step, or indication that the action is destructive. That is risky because users may not realize the operation permanently alters stored data, and broad triggers make accidental invocation more likely.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script stores the activation key in plaintext under the user's home directory without any warning, consent flow, or protection mechanism. License keys can be sensitive credentials in practice, and writing them directly to disk increases the risk of accidental disclosure through backups, local compromise, shared accounts, or overly permissive filesystem access.

Memory Manipulation

High

• Category: Memory Poisoning

Content

- knowledge graph
  - memory stats
  - forget
  - delete memory
  - memory engine
  - 记住
  - 搜索记忆

• Confidence: 88% confidence
• Finding: Memory deletion capability is part of the stated purpose of the skill, so the feature itself is not inherently malicious; however, it is security-sensitive because it allows manipulation of the agent's persistent state. Combined with overly broad triggers and limited warning text, it can be abused or accidentally invoked to remove records, alter future responses, or hide prior context.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: _meta.json:6

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: package.json:8