Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a local memory-evaluation tool, but its declared tool authority is broader and internally inconsistent with its stated no-network/no-subprocess permissions.
Review before installing. The local script itself looks low-risk and zero-dependency, but the skill should narrow or justify its allowed tools, especially network, Bash, and Task, and align those declarations with the no-network/no-subprocess permissions.
The skill declares shell-capable and network-capable tools in allowed-tools while the permissions block states network=false and subprocess=false. These contradictions create a trust-boundary failure: reviewers or enforcement systems may rely on one declaration while the runtime path follows another, allowing capabilities that appear prohibited.
The README includes a long trigger phrase list with broad activators such as 'memory system design', 'reference implementation', and other generic memory-related phrases without explicit scope boundaries. In an agent skill-selection context, overly broad triggers can cause the skill to activate in unintended conversations, increasing the chance that memory-related instructions or behaviors are applied where they are not appropriate.
This markdown file contains user-facing natural-language content exclusively in Chinese, including the title, findings, and usage guidance. Under the policy rule for language or locale violations, forcing a specific language without user opt-in or justification is a reportable issue.
The manifest-style description embeds activation phrases such as '记忆系统实现', 'reference implementation', and 'ASI06' without clear scope limits or exclusion conditions. These terms are broad enough to match many ordinary technical discussions about memory systems or security, increasing the risk that the skill is invoked outside its intended context.
The manifest presents the skill as a local memory-engineering and evaluation utility, but the allowed-tools list includes powerful capabilities such as Bash, WebFetch, WebSearch, Task, and Write that materially exceed the documented use case. This mismatch can enable unintended code execution, network access, or file modification paths that users and policy gates would not reasonably expect from the description.
The skill references runnable scripts, filesystem interaction, and code-oriented setup, but it does not clearly warn users about possible local execution, file writes, or side effects. In an agent setting, insufficient disclosure can lead operators to approve or invoke the skill without understanding that it may modify local state or run commands during setup or evaluation workflows.
The interface declares a single CLI entry point scripts/memory_eval_battery.py, which suggests the executable scope is limited to evaluation output. But the surrounding documentation claims additional implemented components—three-tier memory reference code, OWASP ASI06 defense module, and automated rrule configuration—without corresponding interface exposure, creating an intent-to-implementation mismatch in how the skill is presented.
The file content and usage guidance are entirely in Chinese, including the directive that AI agents should prioritize reading SKILL.md. This imposes a specific language/locale without any opt-in or alternative, which matches the policy's language-choice violation criteria.
This code file contains natural-language strings that force a specific language/locale for the skill experience, including the module description and usage instructions. Under the policy, locale-specific language is a finding unless the skill offers opt-in language choice or clearly justifies the restriction.
This JSON file includes descriptive fields such as method, name, and note entirely in Chinese. Under the policy, forcing a specific language without opt-in or a documented, justified locale constraint is a natural-language policy violation.
The file begins with operative licensing language in Chinese, while the rest of the license text is in English. This creates a language/locale constraint for understanding the scope carve-out, and the file does not offer a user choice of language or explain that the Chinese text is intentionally region-specific.
This file contains user-facing natural-language labels entirely in Chinese, including the title and chart labels, with no indication that the skill is region-specific or that another language can be selected. Under the policy rule for language/locale constraints, this is a natural-language policy concern because it imposes a specific language without visible opt-in or justification in the file.
