T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:14- Finding
Skill instructions attempt to override host policies and force automatic memory operations
- Content
View full analysis
- Remediation
View remediation
Security audit
ecloud-mem0-memory-service
Security checks for vulnerabilities and agentic risk
Overview
This memory skill mostly matches its stated purpose, but it asks for automatic personal-data capture and durable agent-rule changes with weak safeguards.
Review carefully before installing. Use only with a trusted mem0 server over HTTPS, avoid storing secrets or highly sensitive facts, check and purge local logs, protect or rotate the API key, and do not allow the skill to modify AGENTS.md or project rule files to control future agent behavior.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (5)
T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:70- Finding
Skill directs persistent modification of Agent and project rule files
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
memory.js:73- Finding
API credentials and personal memory data can be transmitted over plaintext HTTP
- Content
View full analysis
{ const requestId = crypto.randomBytes(4).toString('hex'); log('INFO', `[${requestId}] >>> ${method} ${pathStr}`); let url; if (method === 'GET' && payload) { const params = new URLSearchParams(); for (const [k, v] of Object.entries(payload)) { if (v !== null && v !== undefined) params.append(k, v); } url = `${BASE_URL}${pathStr}?${params.toString()}`; } else if (method === 'DELETE' && payload) { const params = new URLSearchParams(); for (const [k, v] of Object.entries(payload)) { if (v !== null && v !== undefined) params.append(k, v); } url = `${BASE_URL}${pathStr}?${params.toString()}`; } else { url = `${BASE_URL}${pathStr}`; } log('DEBUG', `[${requestId}] URL: ${url.substring(0, 300)}${url.length > 300 ? '...' : ''}`); const parsedUrl = new URL ...[truncated 2354 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
memory.js:132- Finding
Sensitive memory requests, responses, and search terms are retained in local logs
- Content
View full analysis
{ log('INFO', `[${requestId}] <<< HTTP ${res.statusCode} (${data.length} bytes)`); log('DEBUG', `[${requestId}] 响应: ${data.substring(0, 500)}`); if (res.statusCode === 401) { resolve({ error: '认证失败：API Key 无效或缺失', status: 401 }); return; } if (res.statusCode === 204 || !data.trim()) { resolve({ status: 'success' }); return; } try { const jsonData = JSON.parse(data); resolve(jsonData); } catch (e) { log('ERROR', `[${requestId}] JSON解析失败: ${e.message}`); resolve({ error: `响应解析失败: ${e.message}`, raw: data.substring(0, 500) }); } }); ``` ```javascript if (payload && (method === 'POST' || method === 'PUT')) { const body = JSON.stringify(payload); req.write(body); log('DEBUG', `[${requestId}] 请求体: ${body.substring(0, 500)}`); } ``` ```javascript async function saveMemory(message) { log('INFO', `===== save_memory | ${message.length} 字符 =====`); const payload = { messages: [ { role: 'user', content: message }, { role: 'assistant', content: '好的' } ], user_id: USER_ID }; return await sendRequest('POST', '/memories', payload); } async function searchMemory(query, limit = 5) { log('INFO', `===== search_memory | query= ...[truncated 1491 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
setup.js:75- Finding
Setup overwrites the parent directory environment file
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (28)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 89% confidence
- Finding
If the skill does not actually provide the advertised memory CRUD and protection capabilities, users may provide sensitive personal data expecting secure cloud handling while the real workflow is only setup/local state management. That gap can lead to unsafe handling decisions, over-trust, and misrouting of sensitive information.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the skill does not actually provide the advertised memory CRUD and protection capabilities, users may provide sensitive personal data expecting secure cloud handling while the real workflow is only setup/local state management. That gap can lead to unsafe handling decisions, over-trust, and misrouting of sensitive information.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger conditions are so broad that many ordinary user statements could be automatically saved as long-term memory without meaningful scope limits or confirmation. In a memory skill, overbroad auto-capture materially increases the risk of collecting excessive personal, sensitive, or contextual data the user did not intend to store permanently.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. **所有记忆操作必须通过执行本目录下的 `memory.js` 脚本完成。**
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. **所有记忆操作必须通过执行本目录下的 `memory.js` 脚本完成。**
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md `memory.js` 和 `setup.js` 位于当前 skill 目录下（与 `SKILL.md` 同级）。执行命令时无需切换目录，直接使用相对路径即可。
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The instruction to save 'any information that needs to be remembered long-term' is ambiguous and delegates too much judgment to the agent. This can cause over-collection, including sensitive personal details, and inconsistent privacy outcomes across conversations.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js } function getEnvPaths() { const paths = [path.join(__dirname, '.env')]; paths.push(path.join(__dirname, '..', '.env')); return paths; }
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js } function getEnvPaths() { const paths = [path.join(__dirname, '.env')]; paths.push(path.join(__dirname, '..', '.env')); return paths; }
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The CLI exposes delete and delete-all operations that immediately perform destructive remote actions without any confirmation, preview, or safeguard. Accidental invocation, automation mistakes, or prompt/command confusion could irreversibly erase all stored memories for the configured user.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
The script writes the API key and service endpoint into a plaintext .env file on disk. Even with mode 0600, secrets at rest can be exposed through backups, accidental commits, local compromise, or other tooling that reads workspace files; in a memory-service skill, compromise of this key could grant access to stored long-term user memory and associated personal data.
- Content
js } function saveToEnvFile(config) { const envPath = path.join(__dirname, '..', '.env'); const content = `# mem0 记忆服务配置 # 生成时间: ${new Date().toISOString()}
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The skill description and mandatory trigger phrasing are written to operate specifically on Chinese utterances, and it states the skill must be used when the user says certain Chinese phrases. There is no indication that users may opt into another language or that the locale restriction is required for a region-specific purpose.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill gives contradictory directives: it forbids writing user information to local Markdown files, then later mandates recording configuration details locally. Contradictory instructions increase the chance that the agent will persist sensitive identifiers or endpoints locally despite the stated prohibition, undermining privacy and policy compliance.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill directs the agent to collect an API key and user ID but does not include a clear warning about credential sensitivity, safe handling, or limits on retention. Collecting secrets in conversational workflows without explicit safeguards increases the risk of accidental exposure in chat logs, command history, or local files.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs collecting API keys and persisting configuration for future sessions, which creates a direct risk of credential and identity leakage if stored in chat, shell history, or local project files. In a memory-oriented skill, long-lived retention of such setup data is particularly dangerous because it normalizes persistent storage of secrets alongside personal context.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs the agent to persist user configuration in local project rule/document files even though the skill’s purpose is to use a cloud memory backend. This expands data exposure beyond the intended service boundary and can leave user identifiers, server details, and operational metadata in repository files that may be shared, indexed, or retained indefinitely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill tells the agent to record user configuration details locally without clearly warning the user that their data will persist in local files. Silent local persistence of identifiers and service endpoints is dangerous because users may believe data stays only in the cloud memory system, while it is actually duplicated into workspace artifacts.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Requiring the agent to save the user’s complete original statements without summarization or minimization can capture unnecessary personal data, incidental sensitive details, and secrets embedded in free-form text. This increases privacy risk, breach impact, and compliance concerns because more data than needed is retained verbatim in long-term memory.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Repeating both a ban on local Markdown storage and a requirement to save user configuration locally creates operational confusion and raises the likelihood of insecure persistence. Such ambiguity is especially risky in a memory skill because it handles personal information and long-lived identifiers.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest describes a long-term memory service with full CRUD operations, including listing all memories and deleting all memories, but it does not present clear user-facing warnings about persistence, retention, privacy exposure, or irreversible deletion. In a memory skill that stores personal facts such as names, ages, and preferences, missing disclosure materially increases the risk of collecting sensitive personal data without informed consent and of accidental data loss through destructive operations.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The description claims privacy protections such as memory protection and desensitization, but the implementation forwards raw content directly to the backend without any masking, filtering, or consent workflow. This creates a mismatch that can mislead operators into trusting the tool with sensitive data under false assumptions.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill writes operational logs to a local file and elsewhere logs raw request bodies, user messages, and server responses, which can include highly sensitive memory content and identifiers. Because this skill's purpose is long-term memory handling, the logged data is likely to contain personal information, creating a secondary unprotected data store and increasing disclosure risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The save path sends user-provided memory content to a remote API service with no disclosure or confirmation in the execution flow. In a memory-management skill, remote persistence is expected, but the absence of notice is still risky because users may provide intimate personal data without understanding it leaves the local context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code file contains natural-language strings that present instructions and operational status only in Chinese. Under the policy, forcing a specific language without offering a locale choice is a natural-language policy violation.
- Content