Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed memory-continuity skill, but it automatically reads and persists broad cross-session project memory without clear opt-in or accurate permission scoping.
Install only if you want an agent to automatically restore and update cross-session memory across workspaces. Before using it, require explicit confirmation before loading prior memory, limit reads to the current workspace unless needed, avoid storing secrets or sensitive operational details, and align the declared permissions with the file and memory access the skill actually requires.
The skill is designed to run proactively at the start of every session before the user states a task, causing broad automatic access to prior-session context without clear necessity. Because the recalled data includes project status, brand assets, and key-delivery rules, the overbroad trigger increases the chance of unnecessary exposure of sensitive cross-workspace information.
The skill sets filesystem permission to false, but its core workflow repeatedly instructs reading and writing MEMORY files and scanning workspaces. That discrepancy can bypass user/admin expectations and create unauthorized data access or persistence if the host agent follows the prompt instructions despite the declared permission model.
标题和全文以中文撰写，并面向 AI 代理提供操作说明，但未说明语言选择基于用户偏好、环境配置或区域合规要求。按照规则，若技能在自然语言层面强制特定语言且没有用户选择或明确理由，属于语言/区域策略风险。
The trigger conditions include broad conversational phrases like '你还记得吗' and '失忆了', plus a vague catch-all for 'any continuity-sensitive task'. This can cause the skill to auto-activate in ordinary conversations and inject persisted memory or project-state handling when the user did not explicitly request it, increasing the risk of unintended context loading and disclosure.
The trigger conditions are broad enough to activate on ordinary conversation such as asking whether the agent remembers prior context. In a continuity protocol, accidental activation can cause the agent to load prior-session state or apply stale project facts when the user did not explicitly request it, increasing the risk of context confusion, privacy leakage, or unintended actions in sensitive workflows.
The Chinese trigger phrases are similarly ambiguous and can overlap with normal user language, making unintended activation plausible for Chinese-speaking users. Because this skill is specifically designed to restore memory/state across sessions, ambiguous triggers materially raise the chance of loading or relying on prior context without sufficiently clear user intent.
The trigger phrases are common conversational expressions about memory and continuity, so they can accidentally invoke the protocol in ordinary dialogue. That makes unintended context loading more likely, especially when the protocol is coupled to cross-session recall and file reads.
The protocol directs the agent to proactively reload and retain user/project facts across sessions before any new task is stated, including continuity-sensitive data such as project status and key-handling rules. Preloading sensitive context without task-specific need increases privacy risk and the chance of inappropriate reuse or disclosure.
The metadata is internally inconsistent: it claims API/file/local execution risk in the rationale while the skill is declared prompt-only with all permissions disabled. This mismatch can mislead reviewers and downstream policy engines about what the skill actually does, weakening security gating and making unsafe behavior easier to approve or overlook.
The workflow instructs the agent to read account- and project-level memory files containing sensitive operational facts, including key-delivery rules and cross-workspace project data, without prominently warning users that this access spans multiple workspaces. Users may not realize the protocol broadens data access beyond the current task or workspace.
Treating MEMORY contents as 'finalized hard facts' that must never be re-asked encourages persistent reuse of stored user data without revalidation. This is risky because sensitive information may become outdated, overbroad, or contextually inappropriate, yet still be treated as authoritative across future sessions.
The skill establishes explicit session persistence by directing the agent to write finalized facts into durable memory stores for future reuse. In this context, the persistence is more dangerous because it is cross-workspace/account and tied to continuity-sensitive information, increasing the likelihood of unintended data carryover between tasks and sessions.
- ⚠️ `<your-workspace-root>/_localmem_models` embedding cache **must be kept and backed up** — verification showed HuggingFace re-pull returns **401** (cas-server unreachable). Already-written vectors remain searchable; but **adding new seeds in the future depends on this local cache** — delete it and new memories cannot be written (old ones still searchable).
- ⚠️ localmem is secondary recall; the file layer is always the protagonist. Do not skip writing `_ACTIVE_PROJECTS.md` / MEMORY.md just because localmem exists.
### V. When to add seeds (write path)
When a new finalized hard fact appears (user decided it; it will not change):
1. First write the file layer: account MEMORY.md top "official-account template" section / project MEMORY.md.
2. Then write one semantic seed via localmem `store_memory` (tags incl. SynomosAI / publish / continuity).
The write path stores newly decided 'hard facts' into persistent files and semantic memory across sessions without an explicit user warning or consent flow. This can create durable records of user/project information that outlive the immediate task and may later be recalled in unrelated contexts.
The skill explicitly instructs the agent to persist new user-decided facts into file memory and semantic memory across workspaces/accounts, creating a standing cross-session record. This increases long-term privacy and data governance risk, especially when the stored material may include operational rules, account details, or other sensitive context.
The file is written as an AI-facing control document in Chinese and frames the skill as something agents should prioritize reading, which can effectively steer language and interaction behavior without confirming the user's preference. While not directly a security exploit, forced language behavior can degrade transparency and increase the chance of user misunderstanding around sensitive memory-handling actions.
The skill explicitly instructs agents to restore and reuse prior session or workspace memory for new conversations and for sensitive tasks including publishing, brand assets, release blocking, secret delivery, and project status. This creates a real risk of unauthorized cross-session data reuse, stale-context decisions, and disclosure of sensitive information from prior workspaces or accounts without fresh user consent.
The trigger conditions include very common conversational phrases such as asking whether the assistant remembers prior context, plus broad categories like 'any continuity-sensitive task'. This can cause the skill to activate unexpectedly in normal conversations and may lead the agent to load or prioritize prior state when the user did not explicitly request that behavior.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
The manifest uses Chinese-only natural-language values for the package and author fields, but provides no indication that the skill is region-specific or that users can opt into this locale. Under the policy, locale constraints should either be optional for the user or clearly justified.
No suspicious patterns detected.