Security audit

agent-memory-keeper

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a local memory-auditing skill, but its metadata understates required file access and its instructions describe backup and cleanup changes that the bundled CLI does not implement.

Install only if you intend to audit a specific agent-memory directory or JSONL file. Treat it as read-only unless you separately review and approve any backup, convergence, deduplication, or deletion steps, because the documentation describes those workflows but the bundled CLI does not implement them. Avoid broad memory directories containing unrelated private data.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest declares filesystem access as false, yet the skill's inputs and narrative clearly require reading directories/files and potentially performing backup or cleanup operations. This is a dangerous permission mismatch because downstream systems may trust the manifest for sandboxing or approval decisions, allowing the skill to bypass review expectations or fail open when an agent attempts file operations anyway.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file is written entirely in Chinese and states that AI agents should prioritize reading this skill material, which can force a language choice without user opt-in. In multilingual environments, this can cause the agent to ignore the user's preferred language, misunderstand instructions, or reduce transparency of agent behavior, especially because the routing and usage guidance is embedded in the forced-language content.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: L06 将“AI又忘了我之前说的”“长期记忆怎么管”“记忆库该清理了”等自然表达直接作为适用条件，且同时使用“或要设计/治理一个 agent 的跨会话记忆时使用”这类边界较宽的描述。该文件未提供明确的排除条件或负例，容易与普通对话中关于记忆、整理、治理的泛泛讨论重叠。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The title and primary framing at L01 present the skill as explicitly China/Chinese-oriented, and the document does not state that language choice is optional or user-selectable. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy concern unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The 'When to use' section says to use the skill when 'The user reports memory loss, lost context or confusion,' which is broad enough to overlap with many ordinary conversations that are not specifically about cross-session memory governance. Although more specific examples appear elsewhere, this condition does not clearly limit scope or provide exclusions, increasing the chance of unintended invocation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation advertises state-changing behaviors such as convergence, backup, cleanup, and producing an updated memory snapshot, while the declared interface and output schema present the tool as an audit-only CLI. This mismatch can cause an agent or operator to invoke the skill under false assumptions, leading to unintended modification workflows, unsafe tool orchestration, or hidden side effects not covered by policy review.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The phrase 'Activate via trigger words' references trigger-based activation without clearly specifying required phrases, priority, or when similar language should not activate the skill. This ambiguity can cause accidental invocation, especially because the document mixes broad natural-language examples with a trigger-word mechanism.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The phrase '或要设计/治理一个 agent 的跨会话记忆（笔记/知识库/偏好/项目约定）时使用' is a broad natural-language condition that could match many general conversations about agent design or knowledge management. While the file also lists specific examples and keywords, this broader clause lacks clear boundaries or exclusion conditions, increasing the chance of unintended invocation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The top-level docstring is entirely in Chinese and presents the skill's purpose in a single fixed language. Under the policy rule, forcing a specific language or locale without offering a user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.