Security audit
Security checks for vulnerabilities and agentic risk
The package does not show theft or destructive code, but its broad memory-writing and auto-loading instructions are under-scoped for a simple local benchmark.
Install only if you want a Chinese-first AI memory methodology and local synthetic benchmark. Review or tighten the allowed tools, trigger phrases, and filesystem disclosure before using it in an agent that can write persistent memory, spawn tasks, or auto-load skills from broad keywords.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- 详细列表: 无
### 文件操作与敏感路径检查
- 敏感路径命中: 0 次（无 ~/.ssh / .env / /etc/ / credentials / APPDATA 等）
- 文件操作: scripts/memory_eval_battery.py 仅使用 `open()` 读写 `tempfile.TemporaryDirectory()` 创建的**临时目录**内文件（记忆模拟器），无固定路径、无删除/移动操作、不触碰用户文件
### 网络请求检查
The manifest says filesystem access is disabled, yet the interface and output schema indicate writing a JSON results file. This mismatch can undermine policy enforcement and reviewer trust, and in agent environments may cause the skill to obtain or attempt file-write behavior contrary to declared permissions.
The trigger list is extremely broad and includes common conceptual phrases such as '记忆模型', 'brain memory', and 'learning memory', which can cause the skill to activate in unrelated contexts. Over-broad activation increases the chance of prompt/context hijacking at the orchestration layer by injecting this skill when it was not actually requested, leading to irrelevant instructions being applied to other tasks.
The README advertises a very broad trigger list including generic phrases such as 'AI学习记忆', 'brain memory', and '怎么让AI记住', which are likely to overlap with ordinary user requests outside a narrow skill boundary. In agentic systems that auto-activate skills based on keyword matching, this can cause unintended invocation, expanding the skill's influence over unrelated conversations and increasing the chance of prompt-context hijacking or unsafe behavior propagation from the underlying SKILL.md.
The audit report presents the evaluated skill as a '静态文本分析，只读白名单' and later as effectively read-only, while elsewhere acknowledging that the referenced script performs file writes inside a temporary directory. This is a materially inaccurate safety characterization because it may cause reviewers or users to trust the skill more than warranted and reduce scrutiny of filesystem behavior.
The trigger list is very broad and includes common memory- and learning-related phrases, increasing the chance of unintended activation during normal conversation. In an agent setting, accidental activation can cause the wrong skill to influence responses, load instructions unexpectedly, or steer workflows without clear user intent.
The manifest declares subprocess: false, but the skill interface is a Python CLI entry point that necessarily requires process execution. In an agentic platform, incorrect subprocess declarations can bypass review assumptions, create unsafe execution expectations, and lead to policy violations when the skill is invoked.
The documentation states that 'Doc-interaction mode' and trigger words will automatically load a built-in protocol, implying runtime behavior beyond the declared CLI script. In this file, the only concrete executable interface is the CLI entry point scripts/memory_eval_battery.py, and no implementation or reference for such auto-loading behavior is provided, creating an intent/documentation mismatch rather than a mere omission.
Auto-load behavior tied to unspecified trigger words is risky because it leaves activation conditions undefined and difficult to audit. Ambiguous activation logic can be abused or accidentally invoked, causing unauthorized context injection or unexpected skill selection within a larger agent system.
These lines describe operational memory-management behavior such as storing new information, running background review, and optimizing parameters from a memory-safety report. However, the manifest's concrete interface and capabilities identify the skill as a memory evaluation/benchmark tool, not an autonomous memory storage or review system, so the prose overstates and contradicts what the declared code entry point appears intended to do.
The Chinese section repeats the same ambiguous auto-loading model without clear trigger boundaries, so the risk applies across multilingual use. When activation criteria are unspecified, users and security reviewers cannot reliably predict when the skill will take effect, raising the chance of unintended instruction injection into the session.
The trigger list is extremely broad and includes many generic learning, memory, and educational terms that can appear in ordinary conversation. This can cause unintended invocation of the skill, leading the agent to apply this skill in contexts where it was not requested, which increases prompt-routing confusion and the chance of inappropriate behavior or policy bypass through accidental activation.
The file-level safety claim says evaluation is local/temporary and does not touch real memory artifacts, but the script intentionally persists a JSON results file to a caller-controlled path outside the temporary directory. While the current payload contains only synthetic metrics, the mismatch can mislead operators into assuming nothing is retained, which becomes dangerous if the script is later extended to include real inputs, paths, prompts, or environment-derived data.
This file’s natural-language instructions are entirely in Chinese and present themselves as the operative guidance for agents, but they do not offer the user or operator a language/locale option. Under the language/locale policy, a forced language is a violation unless the skill explicitly provides opt-in or clearly documents a justified regional constraint.
The document is written entirely in Chinese, including headings, findings, and usage guidance, with no indication that the user can choose another language. This can violate a language/locale policy when a skill imposes a specific language without explicit opt-in or documented regional justification.
The report claims both that the package is 'pure documentation + zero-dependency standard-library script' and that it does 'no file touching of any real files,' while also documenting active writes in a temporary directory. This internal contradiction weakens the integrity of the audit and can mislead downstream consumers into believing the package has no write behavior at all.
The title and display name are presented only in Chinese, which can impose a language choice on users despite the file otherwise being bilingual. Under the language/locale policy, forcing a specific language without user opt-in can be a policy concern when not clearly justified.
All user-facing descriptive text and trigger guidance in this file are presented only in Chinese, with no indication that another language is supported or that Chinese is an optional locale. Under the stated policy, a fixed language without user opt-in can be a natural-language policy violation unless clearly justified.
This manifest uses Chinese-only natural-language values for the package and author fields, which can indicate a fixed language/locale assumption. Under the policy rule, forcing a specific language without user choice or justification is a natural-language policy concern, and no opt-in or region-specific rationale is present here.
This JSON file includes user-facing descriptive content and metric labels entirely in Chinese, with no indication that language selection is optional or configurable. Under the policy rules, forcing a specific language without user opt-in is a natural-language locale violation.
This file contains a natural-language note entirely in Chinese, which can impose a specific language on users or downstream operators without opt-in. The policy allows locale constraints only when they are explicitly justified or when a language choice is offered, neither of which is present here.