Remember Me

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:31 PM UTC
• Version: 0.1.2

Overview

This memory skill is mostly coherent, but it can create durable records about the user and inferred preferences without clear consent or tight safeguards.

Install only if you are comfortable with the agent maintaining persistent memory files about your preferences, boundaries, projects, and inferred behavior. Before using it, require explicit approval for every write and promotion, periodically review MEMORY.md and memory/YYYY-MM-DD.md, and do not allow operational instructions, authorization claims, secrets, or third-party content to be stored as preferences.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:31
• Finding: Automatic Persistent Storage of Unverified Behavioral Inferences<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 31–54 and 117–123 **Vulnerability Type**: Persistent memory poisoning through unverified behavioral inference **Risk Level**: Medium ### Complete Code Snippet ```markdown ## Capture Triggers Log memory when any of these happen: - user says “remember this” - a preference appears repeatedly - a boundary is stated (“don’t do X”, “keep Y private”) - a recurring blocker/pattern emerges - project priorities shift meaningfully ## Memory Tiers - **Daily notes**: `memory/YYYY-MM-DD.md` - timestamped raw events, short and factual - **Long-term**: `MEMORY.md` - curated durable profile and preferences ## Write Workflow 1. Classify signal type (preference, boundary, goal, project, blocker, personal context). 2. Append concise timestamped entry to daily memory. 3. Form 1–2 human-like assumptions (hypotheses) from behavior patterns. 4. Tag each assumption with confidence (high/medium/low). 5. Validate assumptions in later conversation with lightweight check-ins. 6. Promote validated, durable items to long-term memory. ``` Related inference instructions at lines 117–123: ```markdown ## Assumption Loop (Human-Like Understanding) For deeper understanding, run this loop continuously: 1. Observe behavior pattern (not just words). 2. Infer a tentative assumption about the user. 3. Store assumption as hypothesis (never as fact initially). 4. Test it with a small conversational probe. 5. Update confidence or discard if contradicted. ``` ### Technical Analysis The skill directs the agent to persist preferences, recurring patterns, blockers, and inferred behavioral characteristics without requiring explicit consent for each write. Explicit consent is only preferred for sensitive information, while ordinary behavioral inferences may be written automatically. Although inferred entries are labeled as hypotheses, they are still placed in persistent daily memory and can later be promoted to `MEMORY.md` ...[truncated 2174 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit user opt-in before every persistent memory write, including preferences, boundaries, behavioral patterns, and hypotheses. 2. Keep inferred hypotheses in ephemeral session state by default. Persist them only after the user confirms both their accuracy and intended retention. 3. Introduce a strict memory schema that permits descriptive user context but rejects: - Instructions to ignore system or developer policies. - Claims that grant authorization or elevated privileges. - Tool-use or command-execution directives. - Secrets, credentials, tokens, and unnecessary sensitive data. - Content copied from untrusted documents, websites, or third parties. 4. Record provenance for every entry, including whether it was explicitly stated, inferred, supplied by a third party, or extracted from external content. 5. Require separate confirmation before promoting an entry from daily memory to `MEMORY.md`. 6. Present stored content to the user for review and provide accessible deletion, correction, and export controls. 7. Apply retention limits to all unconfirmed entries. Delete rather than merely downgrade hypotheses that expire without confirmation. 8. Treat persistent memory as untrusted data when retrieved. Never interpret a stored memory entry as a higher-priority instruction. 9. Add automated tests demonstrating that preference-like prompt injections and operational directives cannot enter durable memory. ]]>

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:68
• Finding: Overbroad Skill Activation and Immediate Promotion of Attacker-Controlled Preferences<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 1–3 and 68–72 **Vulnerability Type**: Insufficient validation before long-term memory promotion **Risk Level**: Medium ### Complete Code Snippet Activation metadata at lines 1–3: ```markdown --- name: remember-me description: Remember-this trigger: memory updates + recall for preferences, goals, boundaries, prior work, decisions, dates, and todos. Use whenever user asks to remember, continue previous context, personalize behavior, or retrieve what was decided earlier. ``` Promotion rules at lines 68–72: ```markdown Promotion guidance: - any explicit preference (any score) - score >= 2 with repetition - score 3 immediately ``` ### Technical Analysis The activation description instructs the agent to use the skill for broad categories such as personalization, prior context, decisions, and TODOs. This creates more opportunities for ordinary or untrusted conversation content to enter the memory workflow. The promotion guidance allows any explicit preference to qualify for promotion and permits entries with an impact score of 3 to be promoted immediately. It does not require an independent confirmation step, provenance validation, a second trusted session, or review of whether the content is descriptive data rather than an operational instruction. An attacker can frame a persistent directive as a preference or high-impact boundary. For example, an instruction affecting future tool use could be phrased as a user preference. If classified as explicit or outcome-critical, it may become durable without repetition. This is a memory-integrity weakness because syntactic framing as a preference is not evidence that content is safe or authorized. ### Attack Path 1. The attacker submits a directive framed as an explicit preference, boundary, decision, or important project constraint. 2. The broad activation rule invokes the memory skill because the content appears relevant to personalization or ...[truncated 1224 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Narrow the activation condition so the skill writes memory only when the user explicitly requests persistence. Requests merely to personalize a current response or discuss prior work should trigger retrieval or session-local context, not automatic storage. 2. Remove immediate promotion based solely on an impact score. 3. Require an explicit confirmation such as a clear approval of the exact normalized memory entry before long-term storage. 4. Separate descriptive preferences from executable or operational directives. Only descriptive data should be eligible for persistence. 5. Require at least two trusted confirmations across separate sessions for inferred or high-impact entries. 6. Add provenance and trust fields to the memory template, including source, confirmation status, creation time, expiration time, and whether the entry contains instructions. 7. Reject entries that attempt to alter safety controls, instruction precedence, authorization, tool permissions, or memory-validation requirements. 8. On retrieval, quote or summarize the relevant memory and ask for confirmation before using high-impact entries to make consequential decisions. 9. Implement conflict detection so newer statements do not silently coexist with contradictory persistent entries. 10. Add audit logging for creation, promotion, modification, and deletion of long-term memory records. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill description activates on very broad conditions such as remembering, continuing previous context, personalization, or retrieving prior decisions, which can cause the memory behavior to trigger in many normal conversations without a sufficiently narrow scope. In a memory-writing skill, this increases the chance of collecting and persisting user data when the user did not clearly intend durable storage, especially because the skill also directs writes to daily and long-term memory files.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Rules:

- FACTS are never inferred
- HYPOTHESES are never promoted without confirmation
- PREFERENCES can remain soft unless explicitly confirmed

## Capture Triggers

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The write workflow instructs the agent to append entries to daily memory and promote items to long-term memory files, but the skill does not require a clear up-front warning that data will be stored persistently across files. This is dangerous because users may believe they are only having an ephemeral conversation while the agent is actually creating durable records, including inferred hypotheses about them.

Static analysis

No suspicious patterns detected.