Xiaoshan Memory Publish

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:28 AM UTC
• Version: 3.3.0

Overview

This memory skill is not clearly malicious, but it needs Review because its install/update path, missing bundled engine, and privacy/storage disclosures leave important user-data risks unresolved.

Install only after reviewing the external engine/update source, preferably using a pinned and verified installer instead of @latest or HTTP downloads. Treat saved memories and search questions as sensitive because provider data flow is unclear, and confirm exactly what /forget will delete before using it. Avoid entering a valuable license key until storage permissions and secret handling are improved.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:30

Finding

Unpinned Remote Package Execution in Installation Instructions

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: _meta.json:6

Finding

Update Archive Is Distributed over Unauthenticated Plaintext HTTP

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/activate.py:11

Finding

License Key Is Accepted via Command Line and Stored in Plaintext

Content

View full analysis

`. 2. The key is recorded in shell history or temporarily exposed in process command-line metadata. 3. The script writes the complete key to `~/.xiaoshan/activation.json`. 4. A local user or process with access to the command history, process metadata, or permissively created file reads the key. 5. The recovered key may be reused wherever the same activation credential is accepted. ### Impact Assessment The direct impact is disclosure and possible unauthorized reuse of the license key. This does not provide remote code execution or privilege escalation by itself. Exploitation requires local access or another process ...[truncated 216 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A second independent mismatch finding states the skill lacks the core storage, search, knowledge graph, and recall/forget features it claims to provide, while instead performing filesystem setup/check operations. This suggests deceptive packaging or substantial undocumented behavior, which is a strong indicator of trust abuse and possible staging for unwanted local changes.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A second independent mismatch finding states the skill lacks the core storage, search, knowledge graph, and recall/forget features it claims to provide, while instead performing filesystem setup/check operations. This suggests deceptive packaging or substantial undocumented behavior, which is a strong indicator of trust abuse and possible staging for unwanted local changes.

Content

No source excerpt is available for this finding.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

- knowledge graph
  - memory stats
  - forget
  - delete memory
  - memory engine
  - 记住
  - 搜索记忆

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README instructs users to run npx clawhub@latest install xiaoshan-memory, which fetches and executes the latest published package version without pinning. If the upstream package is compromised, typosquatted, or a malicious update is released, users may execute attacker-controlled code during installation. In the context of an install command for a memory server skill, this is more dangerous because users are explicitly encouraged to run it locally with full user permissions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The installation command uses npx clawhub@latest, which fetches and executes the newest published package version at install time rather than a reviewed, pinned release. This creates a supply-chain risk: if the package is compromised or a malicious update is published, users may execute attacker-controlled code simply by following the documented install step.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill exposes a deletion capability via /forget and maps natural-language triggers like 删除记忆 to that action, but does not clearly warn that the operation may permanently remove stored memory. In a memory-management skill, ambiguous destructive actions increase the chance of accidental data loss, especially if an agent invokes the endpoint from brief user phrasing without confirmation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 80% confidence

Finding

The skill advertises capabilities that imply local state changes and likely file writes, but it does not declare any explicit tool scope or permissions. Missing scope declarations weaken user and platform visibility into what the skill may access, increasing the chance of unintended local file modification or overbroad execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Broad trigger words like "remember" and "forget" are common in normal conversation and may activate the skill unexpectedly. In a skill that can save or delete memory, accidental activation can lead to unintended persistence, retrieval, or deletion of user data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

Using npx clawhub@latest install ... --force pulls and executes the latest package version at install time, which is a supply-chain risk because the content can change without review. If the upstream package is compromised or updated maliciously, users may execute untrusted code immediately during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill mentions support for external AI providers but does not clearly warn that memory contents, queries, or embeddings may be transmitted off-device. For a memory system, this omission is significant because users may provide sensitive personal or organizational information under the assumption it remains local.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file documents a /forget endpoint that deletes a memory, but it provides no warning about the destructive nature of the operation or its potential irreversibility. Under the markdown-file criteria, user-facing skill documentation should disclose behaviors that may affect user data or integrity.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger table specifies invocation phrases only in Chinese (for example, "记住 X" and "搜索记忆") with no indication that other languages are supported or that Chinese is a justified locale requirement. This is a natural-language policy concern because it imposes a language constraint without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest describes a persistent AI memory engine with semantic search and knowledge graph features, but this file implements license activation state management by storing an activation key in a separate local file. License handling is not an obvious implementation detail of memory storage/search behavior, so the code performs functionality outside the described skill behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script writes the provided activation key in plaintext to ~/.xiaoshan/activation.json without warning the user or protecting the file contents. If the activation key is sensitive, other local users, malware, backups, or support artifacts could recover it and reuse or abuse the license data.

Content

No source excerpt is available for this finding.