Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | 文档与理论文本 | 本 `SKILL.md`、`README.md`、其中「理论依据」段与一切理论表述 | **不在 MIT 覆盖范围内**：保留所有权利（All rights reserved） |
Security audit
cross-session-passphrase
Security checks for vulnerabilities and agentic risk
Overview
The skill openly aims to pass instructions between sessions, but its design uses persistent memory rules that could make another session read and repeat files without clear fresh consent.
Install only if you deliberately want persistent cross-session passphrases that can cause later sessions to act on stored instructions. Avoid using it for secrets, private files, credentials, business data, or anything where each disclosure should require fresh approval.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The description states that trigger-to-action mappings are written into user-level MEMORY.md so that another session can automatically execute actions after receiving a passphrase, including reading files and repeating contents. That is a high-risk cross-session persistence and indirect execution mechanism, yet the manifest does not present a strong warning, consent gate, scope restriction, or approval step for data and system impact. This can lead to unauthorized retrieval, propagation of sensitive information, and actions being taken in a different conversational context than the one where the user granted intent.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest explicitly describes storing trigger-to-action mappings in user-level memory so a different session can later read files and repeat their contents when a passphrase is spoken. This is effectively a covert cross-session command-and-data relay that bypasses normal per-session intent verification and can expose sensitive local content to an unintended conversational context. Because the mechanism is persistent and keyed off natural language, it meaningfully raises the risk of data exfiltration and privilege confusion between sessions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest advertises many broad natural-language trigger phrases such as asking what another session did or how to let another window read a file. Because these overlap with ordinary user conversation and the skill is explicitly designed to react to passphrases and session-transfer language, it creates ambiguous activation boundaries that can cause the skill to engage on unintended prompts. In the context of cross-session memory and retrieval behavior, that ambiguity increases the chance of accidental sensitive data access or relay.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description presents a staged workflow: establish registration and identity anchors, then allow another session to perform retrieval actions automatically. Even if framed as trust and verification methodology, this structure can normalize a false sense of authorization and encourage a second session to act on stored instructions rather than current user intent. That is dangerous because it operationalizes sensitive retrieval after a setup phase, making abuse less visible and harder for users to reason about.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The natural-language skill description is presented only in Chinese, which may impose a language constraint on users without opt-in or alternative locale support. The manifest does not indicate that the skill is intentionally limited to Chinese-speaking users or provide any multilingual option.
- Content
Static analysis
No suspicious patterns detected.