Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a disclosed agent-workflow methodology package, but its persistent memory features and setup guidance create privacy, prompt-injection, and unsafe command risks that should be reviewed before installation.
Install only if you want a stateful workflow skill that writes local memory/log files and you are prepared to review or disable the memory integration. Do not allow stored memory to override higher-priority instructions, restrict where memory files can be written, avoid using attacker-controlled user IDs, and replace the documented curl-to-shell, unpinned npx, and unprotected .env setup steps with pinned and verified alternatives.
docs/OLLAMA_SETUP.md:17Remote Installer Is Downloaded and Executed Without Integrity Verification
integrations/memory_manager.py:117Untrusted Conversation Content Can Poison Persistent Agent Memory
integrations/memory_manager.py:42Unsanitized User Identifier Enables Filesystem Path Traversal
integrations/memory_manager.py:117Conversation History and Persistent Memory May Be Sent to an Unrestricted External AI Provider
AGENTS.md:116Documentation Invokes Unpinned Third-Party Packages
docs/OLLAMA_SETUP.md:81Telegram Bot Token Is Written to a Plaintext Environment File Without Protection Guidance
The declared description presents a general AI-agent work methodology skill covering planning/reporting/safety/context practices. The supplied code does not implement task classification, WBS decomposition, P0/P1 reporting, or safety checks. Instead, it specifically implements conversation memory persistence and summarization infrastructure. While 'Context 管理' is loosely related, the code's primary purpose is memory/history management with filesystem storage and AI-based compression, which is much narrower and materially different from the declared methodology-focused description. Therefore this is a description-behavior mismatch.
The declared description says this skill provides an AI agent methodology/process framework, which is conceptual and workflow-oriented. The actual code instead performs a concrete operational task: archiving old .md log files on disk. This is a materially different primary purpose and introduces filesystem-manipulation capabilities that are not declared. There is no evident connection between task planning/methodology features and this archival behavior, so this should be flagged as a mismatch.
The declared description presents a broad AI-agent workflow/methodology skill, emphasizing planning, reporting, safety, and context-management guidance. The supplied code instead implements a concrete file-maintenance utility for a specific markdown memory file. Its primary behavior is to inspect hot.md, create backups, and delete lines tagged [deprecated] when the file grows beyond a threshold. That is a materially different purpose from the declared methodology skill and introduces undeclared filesystem/content-modification capabilities tied to a specific resource (memory/hot.md). This is not merely a supporting implementation detail of the described methodology; it is an operational maintenance script with a different function.
The declared description presents a workflow/methodology skill for AI agent task management and safety practices. The supplied code does something materially different: it generates a weekly performance report from local metrics data. This is not an implementation detail of task classification, WBS decomposition, reporting prioritization, safety checking, or context management. The code also accesses local logs and writes report files, capabilities not reflected in the declared purpose. Therefore the description does not accurately represent the code's actual behavior.
The declared description presents a general AI agent working methodology skill covering planning, decomposition, reporting, safety, and context management. The provided code instead implements a repository health-check utility that inspects specific files/directories and a line-count threshold in memory/hot.md. This is a materially different primary purpose and introduces filesystem validation capabilities that are not reflected in the description. While '安全检查' is mentioned in the description, this code's concrete behavior is structural file-system checking for a template, not the broader methodology functions claimed. Therefore the description does not accurately represent the supplied code chunk.
声明描述的是高层次的工作方法论与流程指导能力，而实际代码仅实现了一个具体的指标记录脚本。代码没有体现任务类型判断、WBS 拆分、P0/P1 分级汇报、安全检查或 Context 管理等核心宣称能力。其主要功能是将运行指标写入本地日志文件，这属于未在描述中体现的实际能力，且与宣称的主要目的存在明显偏差。因此应判定为描述与行为不匹配。
The declared description presents a high-level agent workflow/methodology skill, but the actual code implements a concrete filesystem utility for locked file writes. This is a materially different primary purpose: instead of providing task-judgment, WBS, reporting, safety-review, or context-management logic, it performs file output with lock acquisition and retry handling. The file-writing and lock-management capabilities are undeclared and unrelated to the stated methodology function, so this is a clear description-behavior mismatch.
There is a clear description-behavior mismatch. The declared purpose describes a cross-platform AI-agent methodology skill offering workflow guidance features, while the actual code only performs recursive keyword search in a local logs directory. This is not a supporting implementation detail of the declared methodology functions, and it introduces filesystem log access that is not mentioned in the description or permissions.
The guide recommends piping a remotely fetched shell script directly into sh, which executes network content without prior verification, review, checksum validation, or signature checks. If the upstream server, DNS, TLS trust path, or distribution script is compromised, users could execute arbitrary code on their machine immediately.
Linux:
curl -fsSL https://ollama.com/install.sh | sh
Windows:
The use of a shell pipeline to pass curl output directly into sh removes an opportunity for users or tooling to inspect the fetched content before execution. This chaining pattern amplifies the risk of remote code execution from a compromised download source and is especially dangerous in setup documentation because users are likely to copy-paste it verbatim.
Linux:
curl -fsSL https://ollama.com/install.sh | sh
Windows:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
python bot.py
### 方式 2：使用 .env 文件
```bash
cd ~/Desktop/smart-agent-template/integrations/telegram
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
python bot.py
### 方式 2：使用 .env 文件
```bash
cd ~/Desktop/smart-agent-template/integrations/telegram
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
python bot.py
### 方式 2：使用 .env 文件
```bash
cd ~/Desktop/smart-agent-template/integrations/telegram
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
python bot.py
### 方式 2：使用 .env 文件
```bash
cd ~/Desktop/smart-agent-template/integrations/telegram
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
python bot.py
### 方式 2：使用 .env 文件
```bash
cd ~/Desktop/smart-agent-template/integrations/telegram
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
python bot.py
### 方式 2：使用 .env 文件
```bash
cd ~/Desktop/smart-agent-template/integrations/telegram
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
python bot.py
### 方式 2：使用 .env 文件
```bash
cd ~/Desktop/smart-agent-template/integrations/telegram
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
python bot.py
### 方式 2：使用 .env 文件
```bash
cd ~/Desktop/smart-agent-template/integrations/telegram
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# 清理缓存重试
rm -rf ~/.ollama/models
ollama pull llama2
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# 清理缓存重试
rm -rf ~/.ollama/models
ollama pull llama2
The protocol instructs agents to modify files and, after user confirmation, execute git push to a remote GitLab repository. Embedding direct remote write instructions in a workflow skill is dangerous because it enables code and document exfiltration or unauthorized repository changes, especially when the skill otherwise presents itself as methodology/governance rather than a deployment or release tool.
This markdown file contains operational instructions entirely in Chinese, beginning with the title and continuing throughout the document. Under the policy for natural-language violations, forcing a specific language without user opt-in or a documented justification is a reportable locale-policy issue.
This is the same underlying issue: the workflow directs use of npx skills without version pinning, creating a supply-chain and arbitrary code execution exposure. Because agent skills may be followed automatically, even an informational lookup command can become dangerous if it triggers remote package resolution and execution.
The skill is presented as workflow methodology, but it also instructs the agent to write user-derived information into persistent logs and memory files as part of normal operation. That expands the skill from guidance into stateful data collection, which increases privacy, retention, and unintended disclosure risk beyond what a user may reasonably expect from a methodology skill.
The instructions direct the agent to collect user corrections, preferences, and standing guidance into persistent files without clear necessity tied to the skill's stated purpose. In practice, this can accumulate sensitive behavioral data or confidential user content, creating avoidable privacy and secondary-use risks if those files are later exposed or reused in unrelated contexts.