Conatus

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:24 AM UTC
• Version: 1.0.1

Overview

This skill is not malicious, but it should be reviewed because it tells an agent to repeatedly read and save summaries of its memory without clear privacy or retention limits.

Install only if you are comfortable with the agent reading daily memory and keeping derived self-analysis logs. Before enabling heartbeat or daily reflection, restrict the source data to non-sensitive metrics, avoid raw conversation or credential content, and define how long generated memory reports should be retained.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:126

Finding

Unrestricted Processing and Persistent Storage of Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 126–139
Vulnerability Type: Sensitive Agent Memory Access
Risk Level: Medium

Vulnerable Code

markdown

### Heartbeat Integration

Add to your agent's `HEARTBEAT.md`:

```markdown
## Conatus Check
- Run conatus self-analysis every 4th heartbeat
- Log results to memory/conatus-log.md
- Alert if score drops below 50

Cron-Based Daily Reflection

Schedule a daily philosophical reflection:

text

Generate a Conatus daily reflection for today.
Review memory/YYYY-MM-DD.md and produce an Ordine Geometrico report.
Save to memory/conatus/YYYY-MM-DD-reflection.md

text

### Technical Analysis

The skill directs the agent to modify its heartbeat configuration, repeatedly process daily memory files, and retain derived reports in persistent memory. Daily memory files can contain unrelated conversation history, personal information, operational details, or other sensitive context. The instructions provide no requirements for explicit user authorization, purpose limitation, field-level filtering, redaction, retention limits, or secure deletion.

Reading an entire daily memory file is broader than necessary to calculate task-completion and recovery metrics. Writing the resulting analysis to additional persistent files also creates derived records that may reproduce or infer sensitive behavioral information. Although the documented behavior does not transmit memory to an external service, it unnecessarily expands the number of persistent locations in which sensitive information may be processed or retained.

The heartbeat modification also causes this processing to recur beyond the immediate invocation. This is not established to be a malicious backdoor or attacker-controlled memory poisoning, so it is classified as an unlisted sensitive-memory-access issue rather than T02 or T06.

### Attack Path

1. A user installs or loads the skill and fo
...[truncated 1478 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit, informed user approval before reading daily memory, modifying HEARTBEAT.md, or enabling recurring analysis.
2. Replace broad access to memory/YYYY-MM-DD.md with a narrow input interface containing only required metrics, such as task counts, error-recovery rates, uptime, and user-approved quality indicators.
3. Prohibit inclusion of raw conversations, credentials, personal data, tool output, and unrelated operational context in generated reflections.
4. Apply deterministic redaction or allowlisting before data is processed or persisted.
5. Make heartbeat and scheduled integration opt-in rather than part of the default usage pattern.
6. Store only aggregate scores when possible, and avoid retaining source excerpts or detailed behavioral narratives.
7. Define retention periods, deletion procedures, file permissions, and maximum log sizes for all generated memory files.
8. Clearly document which files are read, which files are written, how frequently processing occurs, and whether any data is shared externally.
9. Provide a non-persistent mode that generates a report only in the current response without modifying agent memory or configuration.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly instructs the agent to write reflections and logs to persistent memory files (memory/conatus-log.md, memory/conatus/YYYY-MM-DD-reflection.md) without any notice, consent, retention limits, or guidance on what data is safe to store. Because the content is derived from prior agent activity and daily memory files, it can unintentionally persist sensitive prompts, user data, operational details, or internal reasoning artifacts beyond the current session.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.