Security audit
Security checks for vulnerabilities and agentic risk
This memory tool needs review because verified security flaws can expose private memories and allow imported records to write outside its storage folder.
Postpone storing sensitive memories until these flaws are fixed. For evaluation, use isolated, non-sensitive data and local stdio with core tools. Keep the web console on loopback, protect remote MCP traffic with TLS or an encrypted tunnel, and avoid untrusted imports. Do not rely on token scope restrictions or --keep-memories for protection; retain an independently verified backup. Startup-task and credential references alone are not evidence of malicious intent.
bin/yotta-memory.jsUnlocking the Web UI authenticates every reachable client
Disclosure of all unlocked private memories and the library recovery key. Other exposed management endpoints also become accessible.
bin/yotta-memory.jsImported scope bypasses owner validation and permits writes outside the memory root
Creation of attacker-authored Markdown files and directories outside the memory root, wherever the engine's OS account can write. Filenames remain constrained to the generated date/sequence format; arbitrary-file overwrite or code execution is not established.
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
ss.execPath` 指向 Electron 可执行文件），此前生成的任务 / 兜底 / 定时配置不带 `ELECTRON_RUN_AS_NODE=1`，开机拉起的是桌面程序本体、8787 无监听（新机首例实测）。现在自动检测并统一注入：Windows 主任务与每日备份任务（cmd /c + `set "ELECTRON_RUN_AS_NODE=1"`）、Windows Startup 兜底 .cmd（set 前缀）、Linux systemd 单元 / crontab @reboot / 备份定时器（`Environment=` / 行内前缀）、macOS 备份 LaunchAgent（EnvironmentVariables）。
- `lan status` 新增告警：任务或 Startup 兜底命令指向 Electron 可执行文件且缺少 `ELECTRON_RUN_AS_NODE` 时，提示重新 `lan enable` 修复。
- 非 Electron 宿主行为不变（纯 Node 下生成的命令与旧版一致）。
- `test/lan-windows-autostart.test.js` 新增 8 项（Electron / 非 Electron 双态：任务 XML / 兜底 cmd / 备份任务 / Linux 单元与 crontab / macOS plist / status 告警两例）；全量 `npm test` 352/352。
#
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
he current page.
- **Optional embedding plugin (v0.9.0)**: `recall --embedding <command>` or `config set embedding_cmd <command>` runs a local subprocess that accepts JSON on stdin and returns vectors on stdout; results are blended into the same ranking. Failures, timeouts, or malformed output automatically fall back to zero-dependency lexical recall.
- **Embedding cache**: vectors are cached under each memory root at `.embed/cache.json`, keyed by `sha256(command + text)`; only vectors are stored, not plaintext.
- The `tokens` field of `index.json` is a Chinese-tokenization term-frequency table (for TF scoring), **not** an access credential; auth tokens live at `.server/tokens.json`.
- Supports keywords, `--type` filter, `--limit` truncation, project-level priority.
- **Root de-duplication (v0.6.5)**: when project and user roots point at the same directory, recall / context uniquify roots so a file shows once.
- Hits accumulate `access_count` / `last_accessed` for lifecycle management.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
_timeout` / `maintain_archived_utility` / `maintain_decay_halflife_<TYPE>` / `consolidate_*`) |
| `yotta-memory whoami` | Show the current agent identity and registration status |
| `yotta-memory iam <id> [--name <name>] [--user <user>] [--relationship <rel>] [--force]` | Register this agent's unique identity and auto-write the self profile (`agents.json`, ID must be unique) |
| `yotta-memory token new --agent <id> [--force]` / `token list` / `token revoke --agent <id>` | Create / list / revoke access tokens for agents (registered at `.server/tokens.json`) |
| `yotta-memory serve [--host 0.0.0.0] [--port 8787] [--no-auth] [--stdio]` | Start the MCP memory engine (streamable HTTP LAN / --stdio local zero-process mode; Bearer token + X-Agent-Id + X-Agent-Key auth) |
| `yotta-memory lan enable [--onstart] / disable / status` | Autostart management (Windows: scheduled task with an S4U principal — runs silently in the background with no console window; `--onstart` starts at boot without a l
Persistent, potentially self-repairing background service operation is a material capability not disclosed by the memory-system description. This goes beyond ordinary memory storage or retrieval implementation details. The snippet is documentation containing shell commands rather than the underlying implementation, so the platform-specific mechanisms are described rather than independently verified. It does not establish data exfiltration or malicious intent.
Most memory operations and local validation/scanning are consistent with, or support, the declared purpose. However, exposing remotely callable memory operations and modifying OS startup configuration materially extend the resource and operational scope beyond the description. These capabilities are invoked through explicit serve/lan commands rather than demonstrated as automatic execution on load, and authentication is enabled by default; nevertheless, neither network exposure nor OS-level autostart installation is disclosed in the declared description or permissions. The suspicious command strings in scanner rules are detection patterns, not executed malicious commands.
The core memory functionality matches the description, and encryption, indexing, caching, and retrieval metadata are supporting implementation details. However, persistent OS scheduler modification and host process/configuration inspection materially extend the advertised memory-library scope and are not disclosed. These capabilities are conditional on setup, configuration, or diagnostic invocation; the excerpt does not establish that they execute automatically merely by loading the skill. No unrelated network exfiltration is demonstrated.
The memory storage, identity, management interface, and model/embedding integration are consistent with or support the declared memory purpose. However, the supplied implementations go beyond memory-data diff/rollback: runtimeInstallVersion retrieves executable packages, runtimeInstallPrepared installs or overwrites runtime files, runtimeSwitchCurrent changes executable entry points, and runtimeRestartManagedServer controls OS-managed services. These are material software-deployment and service-control capabilities omitted from the description. They appear explicitly invoked rather than automatically triggered. Autostart registration is advertised in help text, but its implementation is not present in this chunk, so it is not treated as demonstrated behavior.
The memory operations, auditing, identity controls, and backups are consistent with the description or reasonable supporting details. However, runtime installation and persistent LAN-service management materially extend beyond the declared memory-storage and retrieval purpose. The CLI explicitly dispatches these operations, while exported helpers indicate Windows startup/task and Linux systemd/cron integration. Most underlying implementations are not included, so this chunk does not establish their exact system effects, any automatic activation, or malicious behavior.
Memory hooks, context paging, and audit logging can reasonably support the declared memory system. However, this chunk also exposes a general external-provider execution mechanism that the description does not disclose. Provider commands are checked for basic validity but are not restricted to approved executables or sandboxed; they run with the host user's privileges. Disabling shell interpretation, filtering environment variables, and limiting execution time and output do not establish a filesystem or network permission boundary. The chunk does not itself demonstrate exfiltration or malicious commands, and execution requires a configured provider and a call to runCapability.
Running a service can support the declared memory functionality, but registering persistent automatic execution modifies operating-system startup configuration—a material capability not disclosed in the description. The supplied chunk is documentation rather than implementation, so it establishes an advertised capability, not proof that startup registration actually occurs.
Running a server can support a memory engine, but registering OS-level autostart introduces persistent execution beyond the declared memory-storage and retrieval capabilities. Permanent memory describes retained data, not automatic process startup. The supplied chunk is documentation rather than implementation, so it establishes an advertised optional capability, not that startup changes occur automatically. It does not establish data exfiltration or a particular network exposure.
Referenced artifact was not completely inspected
yottameta/yotta-memory yotta-memory-install --agent <name>`（或原安装时使用的 `--dir` / `install.sh`）；完成后回读 `yotta-memory --version` 与已安装 `SKILL.md` 的 `version:`，两者不一致时不
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
| 智能体 | 常见 MCP 配置位置 |
|---|---|
| Claude Code | 项目 `.mcp.json` 或用户级 `~/.claude.json` |
| Codex | `~/.codex/config.toml`（`[mcp_servers]`） |
| Cursor | 项目 `.cursor/mcp.json` 或用户级 |
| 其它（Trae / Qwen / Comate / Kimi 等） | 各自 MCP 配置 |
Referenced artifact was not completely inspected
- 协议细节、目录结构与类型规则见 `references/protocol.md`，需要时读取，不要每次全读。
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
> **v0.17.0 升级提示**:升级后请用 0.17.0 引擎执行一次 `yotta-memory reindex`。0.16.7 及更早引擎不识别年/月分层目录,旧引擎重建索引会漏掉分层条目。`doctor` 会报告平铺 / 分层同序号:内容相同的两份只索引一次;内容不同的两份都保留可读并给出路径告警;新写入不复用已占用的序号。
**卸载:** `npm rm -g @yottameta/yotta-memory`,并从智能体的 skills 目录删除整个 `yotta-memory` 文件夹。
## 3. 本机单机使用
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
> **v0.17.0 升级提示**：升级后请用 0.17.0 引擎执行一次 `yotta-memory reindex`。0.16.7 及更早引擎不识别年/月分层目录，旧引擎重建索引会漏掉分层条目。`doctor` 会报告平铺 / 分层同序号：内容相同的两份只索引一次；内容不同的两份都保留可读并给出路径告警；新写入不复用已占用的序号。
**卸载：** `npm rm -g @yottameta/yotta-memory`，并从智能体的 skills 目录删除整个 `yotta-memory` 文件夹。
## 3. 本机单机使用
The remote MCP example sends a bearer token, an agent key, and memory traffic over plaintext HTTP. An attacker able to observe or intercept LAN traffic could steal credentials, read transmitted private memories, and potentially impersonate the agent; encryption at rest does not protect this connection.
distillCore creates private reports with a .md filename and passes them to writeMemoryText, which encrypts only filenames ending in .enc. Consequently, decrypted private statements and derived personal information are persisted as plaintext even in encrypted stores, defeating the skill's confidentiality guarantees.
identityRemoveCore unconditionally deletes both owner-key wrappers before honoring keepMemories for the private directory. In encrypted stores, the retained ciphertext becomes inaccessible through normal recovery or rebinding; the transaction backup may permit recovery, but the option does not actually preserve a usable memory collection.
The CLI accepts and documents --scope for token issuance, but cmdTokenNew stores only the token and creation date, and HTTP authorization never enforces a scope. A client given an apparently restricted token can invoke all enabled tools, including mutation and deletion operations, although separate private-key checks still limit encrypted content access.
appendDedupBlock groups all entries returned by ensureIndex and prints subjects and statement excerpts without first enforcing owner-read permissions. In plaintext stores, that index contains every owner's private entries, so another agent can obtain private content through maintain --dedup, including the MCP tool; write checks during merging do not protect preview output.
The LAN instructions explicitly pair an HTTP endpoint with bearer-token and agent-key authentication headers, exposing those credentials and request contents to observers on the network path. Stolen credentials could enable impersonation and unauthorized memory operations within their permissions; encrypted storage and secure initial key transfer do not protect subsequent HTTP traffic.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- **修复 Electron 宿主（YottaCode shim）下开机自启拉起 GUI 而非服务**：宿主运行时为 Electron 时（`process.versions.electron`；`process.execPath` 指向 Electron 可执行文件），此前生成的任务 / 兜底 / 定时配置不带 `ELECTRON_RUN_AS_NODE=1`，开机拉起的是桌面程序本体、8787 无监听（新机首例实测）。现在自动检测并统一注入：Windows 主任务与每日备份任务（cmd /c + `set "ELECTRON_RUN_AS_NODE=1"`）、Windows Startup 兜底 .cmd（set 前缀）、Linux systemd 单元 / crontab @reboot / 备份定时器（`Environment=` / 行内前缀）、macOS 备份 LaunchAgent（EnvironmentVariables）。
- `lan status` 新增告警：任务或 Startup 兜底命令指向 Electron 可执行文件且缺少 `ELECTRON_RUN_AS_NODE` 时，提示重新 `lan enable` 修复。
- 非 Electron 宿主行为不变（纯 Node 下生成的命令与旧版一致）。
- `test/lan-windows-autostart.test.js` 新增 8 项（Electron / 非 Electron 双态：任务 XML / 兜底 cmd / 备份任务 / Linux 单元与 crontab / macOS plist / status 告警两例）；全量 `npm test` 352/352。
## v0.22.4 (2026-10-07)
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
const dir = opts.launchAgentDir || path.join(os.homedir(), 'Library', 'LaunchAgents');
const plistPath = path.join(dir, BACKUP_LAUNCHD_LABEL + '.plist');
fs.mkdirSync(dir, { recursive: true });
fs.writeFileSync(plistPath, backupLaunchdPlist({
time: time,
nodePath: nodePath,
scriptPath: scriptPath,
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
electronHost: opts.electronHost,
}), 'utf8');
const uid = typeof process.getuid === 'function' ? process.getuid() : '';
const bootstrap = schedulerTry(opts, 'launchctl', ['bootstrap', 'gui/' + uid, plistPath]);
if (!bootstrap.ok) schedulerTry(opts, 'launchctl', ['load', '-w', plistPath]);
return { error: false, scheduler: 'macos-launchd', plist: plistPath, text: '已注册 macOS LaunchAgent 每日备份。' };
}
Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration