T09 · Insecure Skill Coding Practices
Error
- Location
mcp_server.py:294- Finding
Stored Path Traversal Allows File Creation Outside the Workspace
- Content
View full analysis
- Remediation
View remediation
Security audit
memory-guardian-agnet
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent local memory-management skill, but it has a verified workspace-boundary bug that can create files outside the selected workspace from crafted metadata.
Review before installing. Use this only with trusted workspaces, do not run run_batch or memory_decay on a workspace whose memory/meta.json may be attacker-controlled, and patch path validation so all memory files must resolve under the intended workspace/memory directory before enabling cron maintenance.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (97)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description centers on memory lifecycle management operations: ingest/query/archive memories, maintain MEMORY.md and memory/, manage meta.json, quality gates, Bayesian decay, case review, compaction, and batch maintenance. The actual code does none of those directly. Instead, it parses a workspace argument, calls mg_events.telemetry.build_report(), and prints a telemetry summary plus pipeline break candidates. This is a materially different primary purpose: diagnostics/reporting of module telemetry and dataflow, not lifecycle management of memory assets. While diagnostic tooling could be loosely adjacent to maintenance, the specific capabilities shown here—telemetry aggregation and break-candidate reporting—are not represented in the declared description, so this should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description presents a large memory-management subsystem covering installation/configuration, maintenance, decay, quality checks, case review, compaction, ingestion, and synchronization. The supplied code does not implement those responsibilities. Its primary purpose is much narrower: route a query to relevant memory files/categories using tags, token extraction, inverted indexing, activity scoring, and dynamic top-N selection. It reads meta.json and memory file paths, and can print index statistics; it does not manage MEMORY.md, perform compaction, run maintenance batches, enforce quality gates, review cases, or execute ingest/archive/sync workflows. While routing/query support is one small part of the declared scope, the actual chunk's primary behavior is materially different and far more limited than the declared description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The description portrays a comprehensive memory lifecycle management system for an agent workspace, spanning many memory operations and resources. This code chunk instead provides a specialized rule-violation monitor: it writes violation_events.jsonl and rule_health.json under .memory-guardian, analyzes recent violation patterns, reports health, and records rule revisions/cooldowns. While it is plausibly part of a larger memory-guardian ecosystem, this specific chunk does not perform most of the declared responsibilities and introduces a more specific behavior—violation/rule health tracking—not clearly declared. That is a material description-versus-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The supplied code does not perform the declared memory lifecycle management tasks such as managing MEMORY.md, the memory/ directory, meta.json, quality gates, Bayesian decay, case review/lifecycle, compaction, or MCP tool orchestration. Instead, it is a focused telemetry module that records operational statistics for module runs and generates reports from telemetry.json. While telemetry could be a supporting feature of a larger system, this chunk's actual purpose is materially narrower and different from the declared description, and it accesses a different resource (telemetry.json) not mentioned in the declared purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents a comprehensive memory-guardian lifecycle management skill with many capabilities: maintaining MEMORY.md and the memory directory, running batch maintenance, decay/compaction, querying and archiving memories, case review, and quality gate checks through 10 MCP tools. The supplied code chunk, however, is much narrower and materially different in primary purpose. It is a PID adaptive controller focused on adjusting scene-group thresholds stored in meta.json, based on an error signal derived mainly from L3 confirmation coverage. It provides a CLI for status/compute/update/history/reset of PID state. While it does interact with meta.json and quality-gate-related fields, those are only inputs/context for threshold tuning, not the broad lifecycle management described. This is therefore a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description presents a general memory lifecycle management system with 10 MCP tools for ingestion, decay, compaction, quality checks, case review, and batch maintenance. The supplied code chunk is much narrower and materially different: it is specifically a security/risk policy module. Its main functions are parsing AGENTS.md/SOUL.md for hard-coded safety constraints, enforcing those constraints on content, storing extracted security rules in meta.json, and computing risk/action classifications for memory-related operations and cases. While it touches meta.json and active cases, it does not implement the advertised broad memory lifecycle operations such as managing MEMORY.md, performing Bayesian decay, compaction workflows, memory writing/querying/archiving, batch maintenance orchestration, or MCP tool handling. Therefore the declared description does not accurately represent this code chunk’s primary behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description substantially overstates and broadens the code’s purpose. The supplied script is a specific component of memory-guardian dealing with dual-layer access signals for decay: logging accesses, inferring proxy accesses, health-checking stale logs, merging weighted signals into meta.json, and pruning old log entries. While this does relate to the declared theme of memory maintenance and Bayesian decay, it does not implement most of the claimed lifecycle-management capabilities such as managing MEMORY.md, case lifecycle/review, quality gates, compaction, querying/archiving memories, or the full 10-tool MCP surface. This is therefore a material description-to-behavior mismatch, even though the code is plausibly one submodule of the larger system.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is about a substantive memory-management system with many operational capabilities and triggers. The supplied code chunk does not implement any of those behaviors; it only adjusts sys.path for pytest test execution. While this could be ancillary test infrastructure within such a project, the code itself has a materially different immediate purpose and does not reflect the declared functionality. Therefore this chunk does not accurately represent the declared description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description describes a substantial memory-management subsystem with multiple tools and maintenance workflows. The actual code chunk is a minimal unit test for a separate
dataflow_reportmodule and only verifies that itsmain()function exists and is callable. No memory management, file/resource handling, maintenance logic, triggers, or related functionality is present in the provided code. This is a clear description-to-behavior mismatch.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a broad operational memory-management skill with multiple tools and maintenance workflows. The actual code chunk is a narrow unit test module for deduplication-related helper functions such as cosine similarity, zone classification, and nearest-neighbor search. This is materially different in primary purpose and exposed capabilities. While deduplication could be a supporting detail within a memory system, this chunk does not demonstrate the declared lifecycle-management behaviors, resources, or triggers.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description promises a broad operational skill for memory-guardian lifecycle management with many capabilities and triggers. The actual code chunk is only a test module validating helper functions in memory_diff: deterministic file hashing, rule diff structure, and snapshot loading. While snapshot/diff testing is loosely related to memory tooling, it does not implement or expose the described lifecycle management, MCP tools, maintenance workflows, quality systems, case review, or compaction. This is a material description-behavior mismatch because the observed code’s primary purpose is unit testing a narrow diff utility, not managing workspace memory.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents a broad memory lifecycle management system with MCP tools for maintenance, ingestion, decay, compaction, quality checks, case review, and MEMORY.md/meta.json operations. The supplied code chunk instead contains tests for a memory_router component whose primary purpose is query routing via token extraction, tag matching, dynamic category count selection, routing log maintenance, and category activity calculation. While there is slight overlap through use of memory metadata and meta.json, the main behavior in this chunk is routing-related and test-oriented, not lifecycle management or the listed maintenance/tooling functions. That is a material description-versus-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents a broad memory lifecycle management system with many operational capabilities and triggers. The provided code chunk, however, is only a test file for violation tracking utilities. Its observable behavior is limited to testing filesystem paths, event and health JSON persistence, context hashing, and logging of rule violations. While the .memory-guardian naming overlaps with the declared domain, the actual code shown does not implement or demonstrate the primary advertised functions such as memory maintenance, compaction, quality gates, case review, meta.json handling, or MCP tool operations. This is a material description-to-behavior mismatch, not merely an incomplete excerpt of supporting details.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description centers on a broad memory-management/maintenance skill with 10 MCP tools covering MEMORY.md, memory/ directory operations, case lifecycle, compaction, ingestion, querying, and batch maintenance. The actual code shown does not implement or exercise those capabilities. Instead, it is a unit test module for a PID adaptive-threshold subsystem. While there is a loose thematic overlap through use of meta.json and quality-gate/L3-related fields, the primary purpose is materially different: validating adaptive control logic and threshold persistence. No evidence appears of the claimed MCP tools, memory directory management, MEMORY.md lifecycle operations, case review/retirement workflows, or batch maintenance orchestration. Therefore this is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description focuses on memory lifecycle management: ingesting, querying, archiving, decaying, compacting, syncing, and maintaining memory artifacts like MEMORY.md, memory/, and meta.json through 10 MCP tools. In contrast, the code shown does not implement or test memory lifecycle operations. Instead, it tests a separate security layer concerned with scanning content for forbidden/security-sensitive patterns, extracting rules from files like AGENTS.md and SOUL.md, classifying action risk, and evaluating case qualification standards. Although meta.json appears in one test, it is used to store/list security_rules rather than to manage memory lifecycle. This is a materially different primary purpose, with distinct capabilities and triggers, so the description does not accurately represent the supplied code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description claims a comprehensive memory-guardian skill that manages the full workspace memory lifecycle across many operations and tools. The actual code shown is narrowly focused on testing signal collection and merge behavior: access_log.jsonl I/O, stale-log health checks, inference from daily notes/file mtimes, and updating selected meta.json signal fields. While this is related to memory maintenance and meta.json within a memory system, it does not substantiate most of the declared functionality such as 10 MCP tools, MEMORY.md lifecycle management, quality gates, case workflows, compaction, or broad batch maintenance. The primary purpose of the code chunk is therefore much narrower than the declared purpose, making the description materially over-broad relative to the supplied code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description centers on workspace memory management operations: maintaining MEMORY.md and memory/ state, handling meta.json, quality gates, Bayesian decay, case review/lifecycle, compaction, syncing, and batch maintenance through MCP tools. The actual code chunk does not implement or test those functions. Instead, it focuses narrowly on telemetry persistence and reporting for module runs, using a separate .memory-guardian/telemetry.json file and logic around zero-input streaks and pipeline break detection. This is not merely a supporting implementation detail of the declared memory lifecycle behavior; it represents a materially different subsystem with different resources and functionality. Therefore the description does not accurately represent this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
This code does not appear malicious or to perform undeclared external access, but it materially differs from the declared description. The description promises a comprehensive memory-guardian skill with many operational capabilities across memory files, directories, maintenance tasks, and case workflows. The actual code chunk is only a unit test module for anomaly mode state management within a quality-gate/transition subsystem. While anomaly handling could be a supporting part of a larger memory-guardian system, this specific chunk does not implement or expose the declared breadth of functionality. The mismatch is therefore that the declared purpose substantially overstates and mischaracterizes what this code chunk actually does.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python def cmd_health(workspace): """Show rule health summary.""" health = load_health(workspace) rules = health.get("rules", {})
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python def cmd_health(workspace): """Show rule health summary.""" health = load_health(workspace) rules = health.get("rules", {})
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
python } def reset(self): """Reset controller state (keep gains, clear history).""" self.integral = 0.0 self.prev_error = None self.history = []
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python "created_at": _now_iso(), } rules.append(rule) return rules def check_content(content, rules):
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python "created_at": _now_iso(), } rules.append(rule) return rules def check_content(content, rules):
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python "created_at": _now_iso(), } rules.append(rule) return rules def check_content(content, rules):
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill advertises operations that can read environment variables, read/write workspace files, and invoke a Python CLI fallback, but it does not declare any explicit tool scope or allowed-tools boundary. In an agent setting, undocumented capability surface increases the chance of over-privileged execution and unintended file or shell access, especially because the skill manages persistent memory artifacts and scheduled maintenance.
- Content
Static analysis
No suspicious patterns detected.