MindVault 思维永生

• Outcome: Review
• Latest audit: Oct 2, 2026 · 3:58 PM UTC
• Version: 1.2.6

Overview

MindVault is a local conversation archiving skill, but it deserves Review because it can preserve sensitive chat/session data broadly, including raw WorkBuddy records, with limited minimization.

Install only if you are comfortable storing chat history locally in plain JSONL/Markdown. Treat the archive directory as sensitive: avoid archiving secrets, review WorkBuddy exports carefully because raw source records may be copied, and delete or protect archives you no longer need.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (31)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description promises an agent memory and long-term memory management tool that archives dialogue into local JSONL and derives rules/snapshots for persistent memory across sessions and machines. This code chunk instead operates on an existing _index.json metadata file, computing statistics and listing unprocessed archive files. Although helper functions for marking processed files, searching, and summary generation are present, the main entry point explicitly blocks those commands and only allows stats and pending. There is no code here that writes conversation backups to JSONL, performs archival export, extracts rules from history, or manages memory for Claude Code / WorkBuddy / OpenClaw. Therefore the declared description materially overstates and mischaracterizes what this supplied code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description promises a memory management system: backing up dialogue into local JSONL, preventing memory loss across computers/sessions, and extracting rules/snapshots for frameworks like Claude Code or WorkBuddy. The provided code chunk only implements a converter script (jsonl_to_md.py) that parses an existing JSONL file and formats entries as Markdown, optionally writing the Markdown to disk. It uses only local file read/write and does not perform conversation capture, archival pipeline logic, memory retrieval, rule extraction, snapshot generation, or framework integration. While this script may be related to a broader archive tool, the supplied code’s actual behavior is a Markdown renderer/exporter, not the declared memory-management functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

声明描述聚焦于“记忆与长期记忆管理”，核心能力应包括对话历史持久化、JSONL 归档、跨会话记忆保存、从历史提炼规则并生成记忆快照等。实际代码完全没有处理对话内容、JSONL、记忆存储或规则提取；它只读取两份 Markdown 文件，解析更新日志、标题和元数据，并校验两文档是否同步。虽然代码中使用了“snapshot”一词，但这里指项目文档快照，不是用户/Agent 记忆快照。因此该代码与声明用途在主功能、处理对象和实现能力上均明显不符，属于实质性描述-行为不一致。

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.

md

---
name: mindvault
slug: mindvault
displayName: MindVault 思维永生
display_name: MindVault 思维永生
version: "1.2.6"
description: "Agent 记忆与长期记忆管理：对话备份归档成本地 JSONL，防 AI 失忆——换电脑、换会话都不丢记忆；从历史萃取规则生成快照，支持 Claude Code / WorkBuddy / OpenClaw 等本地框架，纯标准库"
display_description: "MindVault 对话归档与记忆进化引擎（基础版免费）：对话增量备份为 JSONL、长期规则萃取、项目快照生成、可选 DRAS-V 五步思考协议。支持 OpenClaw / AutoClaw / Marvis / WorkBuddy / CherryStudio / Coze，数据全部保存在本地。"
keywords:
  - memory
  - 记忆
  - long-term

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 328)May include surrounding context.

md

| `SKILL.md` | 本文件：协议 + 架构 + 命令速查（Agent 直接加载） |

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

WorkBuddy exports include a raw field containing serialized source records, which can preserve far more information than the normalized archive fields, including hidden metadata, prompts, attachments, or other sensitive content. Persisting these raw records into secondary archives without explicit disclosure or minimization significantly increases privacy exposure and downstream leakage risk.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script is explicitly designed to preserve complete conversational state—including messages, tool outputs, file paths, attachments, and sometimes raw records—into durable local archives. In the context of an agent skill with broad filesystem access, this creates a high-value privacy and secret-retention surface because sensitive data that was transient in the live session becomes long-lived and easier to copy or leak.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Line L55 states that timestamps are converted to ISO+08:00, which imposes a specific timezone/locale behavior in natural-language documentation. The file does not indicate that users can choose a timezone or that the +08:00 constraint is justified as a region-specific requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation instructions specify only Chinese phrases for using the skill, which can impose a language requirement on users. The file does not offer equivalent trigger options in other languages or state that users may invoke the skill in their preferred language.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly instructs persistent archival of raw conversation content and acknowledges that passwords, keys, and personal data may be stored if entered. In a skill with read/write/exec permissions, local persistence of sensitive chat content materially increases exposure from host compromise, accidental sharing, backups, or later unintended processing, even if the data is not uploaded.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

L156 says mark, search, and summary in archive_index.py will only prompt and exit, and L167 similarly says full rendering in jsonl_to_md.py requires version checking. But the same lines direct users to an external website for feature/version lookup, which undercuts the repeated positioning elsewhere that the skill is a self-contained local-only standard-library package and creates conflicting operational guidance about what the shipped skill actually supports.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The metadata describes persistent conversation backup, rule extraction, and long-term memory behavior in broad terms, but does not declare any clear activation boundary, consent gate, or scope restriction. In a skill with read/write/exec permissions, this increases the risk that sensitive conversations or workspace data could be archived more broadly than the user expects, creating privacy and data-retention exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The natural-language module documentation states that timestamps are uniformly output in GMT+8 ISO 8601 format, which imposes a fixed locale/timezone convention on all exports. There is no indication that users can opt into another locale or timezone, and no region-specific justification is provided.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The docstring says user messages are kept '100% original' and 'no processing', yet the implementation reclassifies messages starting with [SYSTEM: as role='system' and extracts attachment metadata from embedded tags. That is an active contradiction in documented intent versus actual behavior, not just an omitted detail.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/archive_export.py (reported line 295)May include surrounding context.

python

exec / shell_executor: command（前 200 字）
    web_fetch / web_search: url 或 query
    read / read_text: file_path
    write / write_file: file_path
    dispatch_task: agent_name + task（各前 100 字）
    其他: 第一个非空字符串参数
    """

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/archive_export.py (reported line 295)May include surrounding context.

python

exec / shell_executor: command(前 200 字)
    web_fetch / web_search: url 或 query
    read / read_text: file_path
    write / write_file: file_path
    dispatch_task: agent_name + task(各前 100 字)
    其他: 第一个非空字符串参数
    """

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The WorkBuddy mode resolves and reads session files from ~/.workbuddy/projects/<cwd_key>, which extends the skill's reach into local home-directory data and can export conversations not otherwise scoped by the immediate invocation context. In a memory-archive skill with read/write/exec permissions, this broad local-data access increases the chance of unintentionally exfiltrating sensitive conversation history, secrets, or attachments into secondary archive files.

Content

No source excerpt is available for this finding.

Ssd 2

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The string concatenation used to build 'projects' is a recognizable obfuscation pattern that appears intended to avoid naive keyword or policy checks around sensitive local-data paths. In a skill that accesses home-directory conversation stores, such evasion makes the behavior more suspicious because it hinders review and weakens guardrail effectiveness.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The notes written to the index state '每条目 raw 字段保存源记录完整 JSON 对象，无删减无截断' and imply comprehensive raw preservation. In practice, raw is only attached when wb_emit is called for emitted user/agent/tool entries, while reasoning records are merged into later assistant entries and unmatched source records are not all preserved as standalone raw entries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script writes conversation archives to disk by design, including user, agent, and tool data, without a built-in consent prompt or high-visibility warning at the write point. For a memory skill handling potentially sensitive prompts, tool outputs, file paths, and attachments, silent export materially raises privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring lists mark, search, and summary as subcommands and describes their behavior, but the actual __main__ dispatch rejects those commands with an exit message saying only stats and pending are available. This is an active contradiction between the file's top-level documentation and what the executable interface really does.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file’s docstring and CLI output are entirely in Chinese, including usage guidance and error/help text, with no indication that the user can choose another language. For a general-purpose utility script, this is a natural-language locale policy concern because it imposes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The top-level documentation says the script supports --style full and --css HTML template output, but the argument parser only accepts --style minimal and defines no --css option. This is an active contradiction between the documented interface and the actual executable behavior, not just missing detail.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script can write rendered chat archive contents to a user-specified Markdown file, which may include user messages, agent content, tool details, file paths, and URLs. Although the code prints a success message after writing, it does not warn users beforehand that potentially sensitive archive data will be stored on disk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code file contains extensive user-facing natural-language documentation and CLI help text exclusively in Chinese. Under the stated policy, forcing a specific language without offering the user a language or locale choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.