english-memory-method

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:54 AM UTC
• Version: 0.1.0

Overview

The skill itself is a coherent English memorization helper, but its installers encourage running mutable remote scripts and can persist instructions into multiple agent platforms without verification.

Review the skill content itself as normal educational prompt material, but avoid the documented one-line remote installers. Prefer a reviewed, versioned package or manual installation into only the agent platform you intend to use, and verify the exact files before allowing them to persist in agent instruction directories.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: readme.md:48
• Finding: Mutable Remote Installer Is Downloaded and Executed Without Verification<![CDATA[ ## Vulnerability Details **File Locations**: - `readme.md:42,48,65` - `readme.en.md:42,48,65` - `platforms/README.md:41,46` - `platforms/aider/CONVENTIONS-snippet.md:29,32-33` - `platforms/cline/english-memory-method.md:28,31-32` - `platforms/copilot/copilot-instructions-snippet.md:30,33-34` - `platforms/cursor/english-memory-method.mdc:30,33-34` - `platforms/gemini/GEMINI.md:29,32-33` - `platforms/qoder/english-memory-method.md:27,30-31` - `platforms/roo/english-memory-method.md:27,30-31` - `install.sh:4-5` - `install.ps1:6-8` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code The Unix installation instructions download a script from the mutable `main` branch and pipe it directly into a shell: ```sh curl -fsSL https://raw.githubusercontent.com/yxdwind/english-memory-method/main/install.sh | bash ``` The Windows installation instructions perform the equivalent operation through PowerShell: ```powershell irm https://raw.githubusercontent.com/yxdwind/english-memory-method/main/install.ps1 | iex ``` The primary README files also recommend equivalent commands through jsDelivr: ```powershell irm https://cdn.jsdelivr.net/gh/yxdwind/english-memory-method@main/install.ps1 | iex ``` ```sh curl -fsSL https://cdn.jsdelivr.net/gh/yxdwind/english-memory-method@main/install.sh | bash ``` ### Technical Analysis These commands combine remote retrieval and immediate execution without creating an inspection or verification boundary. The effective payload is obtained from the mutable `main` branch, so the code executed by a user can differ from the version reviewed during this audit. Neither installation method pins the script to an immutable commit, verifies a cryptographic signature, nor compares the downloaded content against a published checksum. The jsDelivr variant mirrors the same mutable repository and therefore does not provide an independent trust boundary. The repository’s currently reviewed ...[truncated 2143 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove every `curl | bash` and `irm | iex` instruction from README files, platform adapters, and installer comments. 2. Separate retrieval, inspection, verification, and execution. For example: - Download the installer to a local file. - Verify its checksum or signature. - Allow the user to inspect it. - Execute the verified local file explicitly. 3. Pin downloads to an immutable release tag or, preferably, a full commit identifier rather than `main`. 4. Publish SHA-256 checksums through a separately protected release channel and require installers to fail closed on a mismatch. 5. Consider signing release artifacts with Sigstore, GPG, or another appropriate code-signing mechanism. 6. Prefer the packaged npm installer because the reviewed `bin/install.mjs` copies files bundled in the installed package and does not retrieve Skill content at runtime. 7. Document a manual installation method for users who do not wish to execute installer code. 8. If CDN mirrors remain available, verify the downloaded artifact against the same immutable, independently published checksum before execution. ]]>

T08 · Insecure Dependencies

Error

• Location: install.sh:17
• Finding: Installers Persist Unverified Mutable Skill Instructions Across Agent Platforms<![CDATA[ ## Vulnerability Details **File Locations**: - `install.sh:17-30,56-64,86-102` - `install.ps1:27-50,75-84,108-125` **Vulnerability Type**: Insecure supply-chain retrieval of persistent agent instructions **Risk Level**: High ### Vulnerable Code The Unix installer selects a mutable branch and downloads Skill files without integrity verification: ```bash REPO="yxdwind/english-memory-method" BRANCH="main" SKILL="english-memory-method" RAW="https://raw.githubusercontent.com/$REPO/$BRANCH" FILES=("SKILL.md" "assets/plan-template.html") # download sources with fallback: raw -> jsdelivr CDN (China-friendly) SOURCES=("https://raw.githubusercontent.com/$REPO/$BRANCH" "https://cdn.jsdelivr.net/gh/$REPO@$BRANCH") fetch() { local rel="$1" out="$2" for s in "${SOURCES[@]}"; do if curl -fsSL --max-time 25 "$s/$rel" -o "$out"; then echo " [OK] $rel <- $s" return 0 fi done echo " [FAIL] $rel (all sources)" >&2 return 1 } ``` It writes those downloaded files directly into persistent Skill directories: ```bash install_to() { local dir="$1" local dest="$dir/$SKILL" for f in "${FILES[@]}"; do mkdir -p "$(dirname "$dest/$f")" if ! fetch "$f" "$dest/$f"; then exit 1; fi done echo "$dest" } ``` In automatic mode, it installs into every detected platform: ```bash for name in "${!PLATFORMS[@]}"; do dir="$HOME/${PLATFORMS[$name]}" if [ -d "$dir" ]; then FOUND=$((FOUND+1)) echo "Platform [$name] detected -> $dir" DESTS+=("$(install_to "$dir")") fi done ``` The PowerShell installer follows the same pattern: ```powershell $Repo = "yxdwind/english-memory-method" $Branch = "main" $Skill = "english-memory-method" $Raw = "https://raw.githubusercontent.com/$Repo/$Branch" $Files = @("SKILL.md", "assets/plan-template.html") $Sources = @( "https://raw.githubusercontent.com/$Repo/$Branch", "https://cdn.jsdelivr.net/gh/$Repo@$Branch" ) function Fetch-File([string]$rel, [string]$out) { foreach ($s ...[truncated 4046 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bundle `SKILL.md` and the HTML template with the installer rather than downloading them at runtime. 2. If network retrieval is required: - Pin every URL to an immutable commit or signed release. - Maintain an authenticated manifest containing the expected path, version, size, and SHA-256 hash of every file. - Verify every file before moving it into an agent directory. - Delete temporary files and abort installation on any verification failure. 3. Replace the PowerShell string check with cryptographic verification and fail closed instead of continuing after a warning. 4. Download files to a temporary staging directory, validate the complete set, and only then perform atomic replacement of the installed Skill. 5. Make installation to one explicitly selected platform the default. Require an affirmative `--all` or equivalent option before modifying every detected platform. 6. Display all target paths and request confirmation before overwriting an existing Skill. 7. Create backups or use versioned installation directories to support safe rollback. 8. Record the installed version, source commit, and verified hashes in local metadata. 9. Prefer the package-local `bin/install.mjs` distribution path, provided the npm package version and provenance are verified. 10. Pin GitHub Actions dependencies to immutable commit hashes and consider npm provenance or trusted publishing to strengthen the release supply chain. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (78)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description is for the functional behavior of an English memorization skill, but the supplied code chunk does not implement any memorization, translation, annotation, SVG generation, or learning-plan logic. Instead, it is purely an installation script that fetches two files from remote sources and installs them into skill directories for multiple agent platforms. This is a materially different primary purpose and includes undeclared capabilities such as network downloading, filesystem modification, and environment/platform detection. Therefore the code chunk does not accurately represent the declared purpose.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The documented one-liner pipes a network response directly into bash, causing immediate execution of whatever the remote server returns. This is dangerous because users cannot inspect the script first, and any compromise of the repository, branch, CDN path, or transport endpoint turns the install command into arbitrary code execution.

Chaining Abuse

High

• Category: Tool Misuse

Content

# english-memory-method installer v3 (Linux / macOS)
#
# One-liner (installs to EVERY detected agent platform):
#   curl -fsSL https://raw.githubusercontent.com/yxdwind/english-memory-method/main/install.sh | bash
#
# Install to specific platform(s), comma-separated:
#   ./install.sh claude,codex,trae

• Confidence: 99% confidence
• Finding: The '| bash' chain is the core unsafe primitive: it converts network-delivered text directly into executed shell commands. In the context of a skill installer, this is especially risky because users may treat the repository as harmless educational content and underestimate that they are authorizing code execution and persistence into agent directories.

Chaining Abuse

High

• Category: Tool Misuse

Content

macOS / Linux:
```bash
curl -fsSL https://raw.githubusercontent.com/yxdwind/english-memory-method/main/install.sh | bash
```

指定平台：

• Confidence: 97% confidence
• Finding: Using a shell pipeline such as `curl ... | bash` removes the opportunity for users or security controls to review the downloaded script before execution, enabling immediate arbitrary command execution. If the upstream source is compromised, the impact can include full user-context system compromise, credential theft, persistence, or lateral movement.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The markdown explicitly instructs users to run remote code using `irm ... | iex` and `curl ... | bash` without any warning, review step, or trust boundary explanation. In a learning/memorization skill, this is unrelated to the stated purpose and creates a direct path to arbitrary code execution if the remote script is malicious or later modified.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The markdown explicitly instructs users to run remote scripts via `irm ... | iex` and `curl ... | bash` without any warning, verification, or code review guidance. This is a classic dangerous pattern because it executes arbitrary code from the network immediately on the user's machine, and a compromised repository, MITM-adjacent trust failure, or future script update could result in arbitrary command execution.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: A memorization skill has no justified need to instruct users to run remote shell installers, especially via `irm ... | iex` and `curl ... | bash`, which execute unreviewed code immediately. In this context, the capability is unrelated to the functional goal and materially increases the chance of social-engineering users into unsafe code execution.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The file embeds one-line remote installation commands that fetch and execute code directly from the network (`irm ... | iex`, `curl ... | bash`). Even though presented as optional installation instructions for a 'full version', this is dangerous because it conditions users to run unreviewed remote scripts, enabling arbitrary code execution if the upstream content is compromised or replaced.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The markdown explicitly instructs users to run remote installation commands without any warning about executing untrusted code or system impact. Because these commands fetch and immediately execute remote content, a compromised upstream source or malicious update could result in full arbitrary command execution on the user's machine; the educational context makes this more dangerous because users may not expect system-level risk from a memorization skill.

External Script Fetching

High

• Category: Supply Chain

Content

**macOS / Linux**:

```bash
curl -fsSL https://cdn.jsdelivr.net/gh/yxdwind/english-memory-method@main/install.sh | bash
```

**Claude Code (zero CLI)**:

• Confidence: 98% confidence
• Finding: `curl -fsSL ... | bash` fetches a script from an external source and immediately executes it, creating a classic arbitrary code execution path. If the remote source, dependency chain, or transport endpoint is compromised, any command can run with the user's privileges, making this especially risky in installation instructions for broad multi-platform deployment.

Chaining Abuse

High

• Category: Tool Misuse

Content

**macOS / Linux**:

```bash
curl -fsSL https://cdn.jsdelivr.net/gh/yxdwind/english-memory-method@main/install.sh | bash
```

**Claude Code (zero CLI)**:

• Confidence: 97% confidence
• Finding: The use of shell chaining to stream untrusted remote content directly into `bash` removes any opportunity for review and amplifies the risk of command injection or malicious installer behavior. In this skill context, the command is presented as a convenience install path for many agent platforms, which increases exposure because users are encouraged to run it as part of setup.

External Script Fetching

High

• Category: Supply Chain

Content

**macOS / Linux**：

```bash
curl -fsSL https://cdn.jsdelivr.net/gh/yxdwind/english-memory-method@main/install.sh | bash
```

**Claude Code（零命令行）**：

• Confidence: 99% confidence
• Finding: `curl -fsSL .../install.sh | bash` fetches a script from an external source and executes it immediately, granting arbitrary code execution to the remote content provider. Because the URL targets a mutable branch (`@main`) via a CDN mirror, any compromise or unexpected change to that content would be executed on the user's system without an opportunity for review.

Chaining Abuse

High

• Category: Tool Misuse

Content

**macOS / Linux**：

```bash
curl -fsSL https://cdn.jsdelivr.net/gh/yxdwind/english-memory-method@main/install.sh | bash
```

**Claude Code（零命令行）**：

• Confidence: 97% confidence
• Finding: The `| bash` construct is dangerous because it chains network retrieval directly into command execution, removing any separation between untrusted input and privileged local actions. This pattern magnifies the blast radius of any compromise in the hosting source and is especially risky here because the installer is described as modifying multiple agent platforms automatically.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger phrases include broad, everyday requests such as '帮我背' and '和上面一样的记忆技巧', which can cause the skill to activate in contexts broader than intended. Over-broad activation increases the chance of unintended invocation, context hijacking, or routing user content into a complex transformation flow without clear consent.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: Defaulting translation output to Chinese without explicit user opt-in can cause unintended disclosure or transformation of user-provided content into a language the user did not request. In multilingual or privacy-sensitive settings, this can lead to poor data handling expectations, incorrect outputs, or accidental exposure to downstream readers.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The HTML root sets `lang="zh-CN"`, which establishes a fixed Chinese locale for the entire template. This is reinforced by surrounding instructional text that presents Chinese as the default output, creating a language policy issue because the skill does not ask for user preference first.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The template states '翻译默认中文' and repeats that the translation is Chinese by default unless the user asks otherwise. This imposes a language choice before user opt-in, which matches the policy category for forced language or locale.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The installer creates directories and copies skill files into user agent skill locations without any confirmation prompt, dry-run, or clear pre-write warning. In the context of agent skills, silently installing content across multiple tool-specific directories increases the chance of unexpected trust-boundary changes and accidental persistence of unreviewed prompt/code artifacts.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The installer downloads remote content from GitHub or jsDelivr and writes it directly into local skill directories, with the header even encouraging pipe-to-iex execution. This combines remote code/content trust with silent local configuration changes, which is risky because users may not review what is fetched or where it is installed, and any upstream compromise would immediately affect local agent behavior.

Static analysis

No suspicious patterns detected.