MindVault 思维永生

• Outcome: Review
• Latest audit: Sep 18, 2026 · 8:14 AM UTC
• Version: 1.2.2

Overview

MindVault is a local chat-archive memory skill, but it deserves Review because it asks for broad read/write/exec access and persistent storage while the scripts it tells agents to run are missing from the submitted package.

Install only if you intentionally want local long-term storage of agent conversations and derived memory. Before using it, verify the actual scripts from a trusted source, run them from an expected directory, choose narrow session and archive paths, and avoid archiving chats that contain secrets unless you are prepared to review and delete those records yourself.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: mindvault
slug: mindvault
displayName: MindVault 思维永生
display_name: MindVault 思维永生
version: "1.2.2"
description: "把 Agent 对话归档成可检索的本地 JSONL（每 15 轮一分片），从历史对话萃取规则、生成项目快照、快速恢复上下文；纯本地存储、用户主动触发，输出 archive/*.jsonl + FACT.md + PROJECT_SNAPSHOT.md"
display_description: "MindVault 对话归档与记忆进化引擎（基础版免费）：对话增量备份为 JSONL、长期规则萃取、项目快照生成、可选 DRAS-V 五步思考协议。支持 OpenClaw / AutoClaw / Marvis / WorkBuddy / CherryStudio / Coze，数据全部保存在本地。"
keywords:
  - 对话备份
  - 对话�

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Ae1

High

• Category: analysis-evasion

Content

| `SKILL.md` | 本文件：协议 + 架构 + 命令速查（Agent 直接加载） |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The README presents the skill entirely in Chinese and includes Chinese trigger phrases, but does not offer a language choice or document that the skill is intended only for a Chinese-language audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The README defines optional reasoning activation with broad natural-language triggers like “走流程” / “DRASV” rather than a strict, namespaced command format. In an agent skill with read/write/exec permissions, ambiguous activation can cause unintended entry into a more powerful workflow during ordinary conversation, increasing the chance of unexpected tool use or procedural side effects.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The text says archive/evolution/snapshot actions occur when the user 'actively says trigger words' but does not precisely define the allowed trigger vocabulary. That ambiguity can lead an agent to misinterpret ordinary text as consent for persistence operations, which is risky because the skill stores conversation data locally and has write/exec capabilities.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The skill is explicitly designed to persist full conversation content to local archives, and it warns that passwords, keys, and personal data entered by the user may be stored as-is. This creates a real data-retention risk: secrets disclosed during ordinary chat can become durable local records that may later be accessed by other tools, users, backups, or malware on the host.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: Extracting rules from archived conversations into long-term memory extends the lifetime and reach of user-provided content beyond the original session. Even if intended for convenience, sensitive facts can be semantically transformed into persistent memory files, increasing the chance of later disclosure, unintended reuse, or propagation into future outputs.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: This is a markdown file, so SQP-3 applies. Line L02 uses Chinese-only natural-language release text about version naming adjustments, and the file does not indicate that language choice is optional or that the skill is intentionally limited to a Chinese-speaking audience; this can conflict with a language/locale policy requiring user opt-in or documented justification.

Intent-Code Divergence

Low

• Confidence: 92% confidence
• Finding: This is an active contradiction in the documentation itself: line L075 says all backup files are written to the local archive/ directory, while multiple later sections describe writing rule and snapshot artifacts outside that directory. The issue is not merely incomplete wording; it conflicts with the broader documented behavior of the skill.

Description-Behavior Mismatch

Low

• Confidence: 78% confidence
• Finding: The manifest description emphasizes '纯本地存储' and outputs limited to local files, which suggests the skill's scope is confined to local archival and processing. However, the skill file embeds an external acquisition/distribution path via a commercial URL and later states 'Coze | API 拉取', indicating a broader ecosystem interaction than the strict local-only description implies.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: The display name includes Chinese-only wording ("思维永生"), and other user-facing manifest fields such as pricing details are also written in Chinese, but the manifest does not indicate that the skill is intended only for a Chinese-speaking or China-region audience. Under the language/locale policy, forcing a specific language without opt-in or justification is a natural-language policy concern.

Description-Behavior Mismatch

Low

• Confidence: 78% confidence
• Finding: The manifest description frames the skill as a local archival tool that produces local JSONL and markdown artifacts. However, the pricing note and paid link metadata indicate gated additional commands and external product distribution, which expands the apparent functional scope beyond the concise description of the skill's behavior.

Static analysis

No suspicious patterns detected.