T02 · Agent Memory Poisoning
Warning
- Location
setup.md:111- Finding
Persistent Agent Steering Through Global Control-File Modification
- Content
View full analysis
- Remediation
View remediation
Security audit
Self-Improving Proactive Decision Making Agent
Security checks for vulnerabilities and agentic risk
Overview
This decision-support skill is useful and mostly coherent, but it persistently profiles decision habits and asks to modify global agent steering files, so it belongs in Review before installation.
Install only if you want a local, persistent decision profile. Review the proposed SOUL.md, AGENTS.md, and HEARTBEAT.md edits carefully, consider skipping global steering integration, and periodically inspect or delete ~/decision-making/ if it contains sensitive personal or business decisions.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (17)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The user-facing description says the agent 'learns your decision style, risk profile, and framework preferences over time' but does not clearly warn that this information is stored persistently across interactions in local files. That omission undermines informed consent, especially because the stored data can reveal behavioral tendencies, priorities, and decision history that many users would reasonably consider sensitive.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The activation conditions are broad enough to trigger on routine phrases like 'what do you think' or any implicit tradeoff, which can cause the skill to engage and begin memory-related behavior outside a clearly bounded decision-support context. In a skill that persists user preferences over time, overbroad activation materially increases the chance of collecting or surfacing personal behavioral data without sufficiently explicit user intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The automatic learning triggers are generic conversational statements that commonly occur in ordinary dialogue, yet they instruct the agent to update persistent files like memory.md, frameworks.md, and domain files. This creates a privacy and scope-control risk because the skill may infer and store durable preference or risk-profile data from ambiguous, one-off statements without robust consent or contextual validation.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This section directs the agent to automatically learn, persist, and later use user decision preferences and risk-profile information derived from conversation. Even though the intent is personalization, the behavior creates a durable profile from conversational signals, which can expose sensitive behavioral inferences and exceed user expectations if done automatically.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The proactive template instructs the agent to reference stored past preference data without the user first requesting retrieval in the current interaction. Surfacing prior memory unprompted increases the chance of unwanted disclosure to someone viewing the conversation and may feel invasive even if the data is accurate.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The quick-query behaviors allow direct printing or summarization of persistent memory such as risk profile, preferences, and decision history. While useful for transparency, these retrieval paths can disclose sensitive long-term profiling data too readily if invoked casually, ambiguously, or in a shared environment.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | Financial specifics | Card numbers, bank accounts, exact salaries | Fraud / privacy risk | | Medical | Diagnoses, medications, conditions | Privacy, HIPAA | | Biometric | Voice patterns, behavioral fingerprints | Identity theft | | Third parties | Other people's preferences, decisions, constraints | No consent obtained | | Location patterns | Home/work addresses, travel routines | Physical safety | ## Store with Caution
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger condition 'User revisits a past decision by name or date' is broad enough to activate on ambiguous references that may not reflect actual intent to begin a retrospective. In a memory-bearing, proactive agent, this can cause unsolicited retrieval and follow-up about prior decisions, increasing the risk of privacy-invasive prompting, mistaken context carryover, and user confusion in high-stakes domains.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Allowing the agent to trigger a retrospective when it 'notices a contradiction between a past decision and new information' delegates activation to a subjective model judgment with no objective threshold. In a self-improving agent that updates memory and patterns over time, this can lead to hallucinated contradictions, unwanted memory edits, and proactive interventions based on incorrect inferences.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Generalizing risk profile from high-pressure decisions (constraints skew behavior) - Over-indexing on recency (last decision ≠ always right rule) - Applying domain weight to wrong domain silently - Confirming a preference without asking after 3 signals ---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The template explicitly states that a file will be created in the user's home directory and then used and updated over time, but it does not present a clear upfront warning, consent step, or controls for persistent storage. Persistent writes in a home directory can expose sensitive preference data, create privacy surprises, and normalize silent statefulness across sessions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill stores inferred preferences, behavioral signals, and confirmed rules, but the template does not include a clear privacy disclosure describing this collection and retention. Because the skill is designed to learn decision style over time, the context increases sensitivity: even seemingly benign preference data can reveal risk appetite, personal priorities, and behavioral patterns.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The command phrases are broad enough to overlap with normal conversation, which can cause the agent to trigger memory reads, recalls, or workflow actions when the user did not intend to invoke the skill. In a memory-bearing decision assistant, accidental activation increases privacy and integrity risk because sensitive preferences, past decisions, and learned patterns may be surfaced or acted on unexpectedly.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The listed deletion commands enable broad memory erasure, including full wipe, without an explicit safety warning or mandatory confirmation flow in the operations spec. If triggered accidentally or through ambiguous phrasing, the user could lose all stored decision history and preferences, creating irreversible integrity and availability harm.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill automatically loads memory and context files at session start and on decision requests without any user-facing notice or consent step. Because these files contain risk profiles, preferences, and historical decisions, silent retrieval can expose sensitive personal data and may violate user expectations about when stored memory is accessed.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The setup instructs the skill to modify global steering files (
SOUL.md,AGENTS.md, andHEARTBEAT.md), which extends the skill’s influence beyond its own scoped memory files and affects future agent behavior across unrelated tasks. Even though the stated purpose is decision-support continuity, persistent changes to global instruction files create an unnecessary trust boundary violation and could be abused to bias, over-prioritize, or entrench this skill’s behavior over time.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The template explicitly states that a file will be created under the user's home directory on first use, but it does not mention obtaining explicit consent or warning the user that local files will be modified. In an agent skill that maintains self-improving memory, silent filesystem writes can surprise users, create privacy concerns, and normalize broader unauthorized persistence behavior.
- Content