Security audit

english-memory-method

Security checks for vulnerabilities and agentic risk

Overview

The skill itself is a coherent English memorization helper, but its installers encourage running mutable remote scripts and can persist instructions into multiple agent platforms without verification.

Review the skill content itself as normal educational prompt material, but avoid the documented one-line remote installers. Prefer a reviewed, versioned package or manual installation into only the agent platform you intend to use, and verify the exact files before allowing them to persist in agent instruction directories.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: readme.md:48
Finding: Mutable Remote Installer Is Downloaded and Executed Without Verification
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: install.sh:17
Finding: Installers Persist Unverified Mutable Skill Instructions Across Agent Platforms
Content: View full analysis
jsdelivr CDN (China-friendly) SOURCES=("https://raw.githubusercontent.com/$REPO/$BRANCH" "https://cdn.jsdelivr.net/gh/$REPO@$BRANCH") fetch() { local rel="$1" out="$2" for s in "${SOURCES[@]}"; do if curl -fsSL --max-time 25 "$s/$rel" -o "$out"; then echo " [OK] $rel <- $s" return 0 fi done echo " [FAIL] $rel (all sources)" >&2 return 1 } ``` It writes those downloaded files directly into persistent Skill directories: ```bash install_to() { local dir="$1" local dest="$dir/$SKILL" for f in "${FILES[@]}"; do mkdir -p "$(dirname "$dest/$f")" if ! fetch "$f" "$dest/$f"; then exit 1; fi done echo "$dest" } ``` In automatic mode, it installs into every detected platform: ```bash for name in "${!PLATFORMS[@]}"; do dir="$HOME/${PLATFORMS[$name]}" if [ -d "$dir" ]; then FOUND=$((FOUND+1)) echo "Platform [$name] detected -> $dir" DESTS+=("$(install_to "$dir")") fi done ``` The PowerShell installer follows the same pattern: ```powershell $Repo = "yxdwind/english-memory-method" $Branch = "main" $Skill = "english-memory-method" $Raw = "https://raw.githubusercontent.com/$Repo/$Branch" $Files = @("SKILL.md", "assets/plan-template.html") $Sources = @( "https://raw.githubusercontent.com/$Repo/$Branch", "https://cdn.jsdelivr.net/gh/$Repo@$Branch" ) function Fetch-File([string]$rel, [string]$out) { foreach ($s ...[truncated 4046 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (78)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is for the functional behavior of an English memorization skill, but the supplied code chunk does not implement any memorization, translation, annotation, SVG generation, or learning-plan logic. Instead, it is purely an installation script that fetches two files from remote sources and installs them into skill directories for multiple agent platforms. This is a materially different primary purpose and includes undeclared capabilities such as network downloading, filesystem modification, and environment/platform detection. Therefore the code chunk does not accurately represent the declared purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documented one-liner pipes a network response directly into bash, causing immediate execution of whatever the remote server returns. This is dangerous because users cannot inspect the script first, and any compromise of the repository, branch, CDN path, or transport endpoint turns the install command into arbitrary code execution.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The '| bash' chain is the core unsafe primitive: it converts network-delivered text directly into executed shell commands. In the context of a skill installer, this is especially risky because users may treat the repository as harmless educational content and underestimate that they are authorizing code execution and persistence into agent directories.
Content: Scanner excerpt · install.sh (reported line 5)May include surrounding context.
sh
# english-memory-method installer v3 (Linux / macOS) # # One-liner (installs to EVERY detected agent platform): # curl -fsSL https://raw.githubusercontent.com/yxdwind/english-memory-method/main/install.sh | bash # # Install to specific platform(s), comma-separated: # ./install.sh claude,codex,trae

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: Using a shell pipeline such as curl ... | bash removes the opportunity for users or security controls to review the downloaded script before execution, enabling immediate arbitrary command execution. If the upstream source is compromised, the impact can include full user-context system compromise, credential theft, persistence, or lateral movement.
Content: Scanner excerpt · platforms/README.md (reported line 46)May include surrounding context.
macOS / Linux:

bash
curl -fsSL https://raw.githubusercontent.com/yxdwind/english-memory-method/main/install.sh | bash

指定平台：

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The markdown explicitly instructs users to run remote code using irm ... | iex and curl ... | bash without any warning, review step, or trust boundary explanation. In a learning/memorization skill, this is unrelated to the stated purpose and creates a direct path to arbitrary code execution if the remote script is malicious or later modified.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The markdown explicitly instructs users to run remote scripts via irm ... | iex and curl ... | bash without any warning, verification, or code review guidance. This is a classic dangerous pattern because it executes arbitrary code from the network immediately on the user's machine, and a compromised repository, MITM-adjacent trust failure, or future script update could result in arbitrary command execution.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: A memorization skill has no justified need to instruct users to run remote shell installers, especially via irm ... | iex and curl ... | bash, which execute unreviewed code immediately. In this context, the capability is unrelated to the functional goal and materially increases the chance of social-engineering users into unsafe code execution.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file embeds one-line remote installation commands that fetch and execute code directly from the network (irm ... | iex, curl ... | bash). Even though presented as optional installation instructions for a 'full version', this is dangerous because it conditions users to run unreviewed remote scripts, enabling arbitrary code execution if the upstream content is compromised or replaced.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The markdown explicitly instructs users to run remote installation commands without any warning about executing untrusted code or system impact. Because these commands fetch and immediately execute remote content, a compromised upstream source or malicious update could result in full arbitrary command execution on the user's machine; the educational context makes this more dangerous because users may not expect system-level risk from a memorization skill.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: curl -fsSL ... | bash fetches a script from an external source and immediately executes it, creating a classic arbitrary code execution path. If the remote source, dependency chain, or transport endpoint is compromised, any command can run with the user's privileges, making this especially risky in installation instructions for broad multi-platform deployment.
Content: Scanner excerpt · readme.en.md (reported line 48)May include surrounding context.
macOS / Linux:

bash
curl -fsSL https://cdn.jsdelivr.net/gh/yxdwind/english-memory-method@main/install.sh | bash

Claude Code (zero CLI):

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The use of shell chaining to stream untrusted remote content directly into bash removes any opportunity for review and amplifies the risk of command injection or malicious installer behavior. In this skill context, the command is presented as a convenience install path for many agent platforms, which increases exposure because users are encouraged to run it as part of setup.
Content: Scanner excerpt · readme.en.md (reported line 48)May include surrounding context.
macOS / Linux:

bash
curl -fsSL https://cdn.jsdelivr.net/gh/yxdwind/english-memory-method@main/install.sh | bash

Claude Code (zero CLI):

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: curl -fsSL .../install.sh | bash fetches a script from an external source and executes it immediately, granting arbitrary code execution to the remote content provider. Because the URL targets a mutable branch (@main) via a CDN mirror, any compromise or unexpected change to that content would be executed on the user's system without an opportunity for review.
Content: Scanner excerpt · readme.md (reported line 48)May include surrounding context.
macOS / Linux：

bash
curl -fsSL https://cdn.jsdelivr.net/gh/yxdwind/english-memory-method@main/install.sh | bash

Claude Code（零命令行）：

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The | bash construct is dangerous because it chains network retrieval directly into command execution, removing any separation between untrusted input and privileged local actions. This pattern magnifies the blast radius of any compromise in the hosting source and is especially risky here because the installer is described as modifying multiple agent platforms automatically.
Content: Scanner excerpt · readme.md (reported line 48)May include surrounding context.
macOS / Linux：

bash
curl -fsSL https://cdn.jsdelivr.net/gh/yxdwind/english-memory-method@main/install.sh | bash

Claude Code（零命令行）：

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases include broad, everyday requests such as '帮我背' and '和上面一样的记忆技巧', which can cause the skill to activate in contexts broader than intended. Over-broad activation increases the chance of unintended invocation, context hijacking, or routing user content into a complex transformation flow without clear consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Defaulting translation output to Chinese without explicit user opt-in can cause unintended disclosure or transformation of user-provided content into a language the user did not request. In multilingual or privacy-sensitive settings, this can lead to poor data handling expectations, incorrect outputs, or accidental exposure to downstream readers.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The HTML root sets lang="zh-CN", which establishes a fixed Chinese locale for the entire template. This is reinforced by surrounding instructional text that presents Chinese as the default output, creating a language policy issue because the skill does not ask for user preference first.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The template states '翻译默认中文' and repeats that the translation is Chinese by default unless the user asks otherwise. This imposes a language choice before user opt-in, which matches the policy category for forced language or locale.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The installer creates directories and copies skill files into user agent skill locations without any confirmation prompt, dry-run, or clear pre-write warning. In the context of agent skills, silently installing content across multiple tool-specific directories increases the chance of unexpected trust-boundary changes and accidental persistence of unreviewed prompt/code artifacts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The installer downloads remote content from GitHub or jsDelivr and writes it directly into local skill directories, with the header even encouraging pipe-to-iex execution. This combines remote code/content trust with silent local configuration changes, which is risky because users may not review what is fetched or where it is installed, and any upstream compromise would immediately affect local agent behavior.
Content: No source excerpt is available for this finding.