T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:179- Finding
Untrusted User Preferences Can Poison Persistent Shared Skill State
- Content
View full analysis
- Remediation
View remediation
Security audit
fasaha
Security checks for vulnerabilities and agentic risk
Overview
This Arabic editing skill is mostly purpose-aligned, but it tells agents to persist user-derived preferences and corrections into shared skill files without clear isolation or confirmation.
Install only if you are comfortable with agents modifying the skill's own reference files over time. Prefer using it with the skill directory read-only, or move preferences and terminology to a per-user or per-project store with confirmation before saving entries.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger description is very broad and includes common activities like translating into Arabic, writing in Arabic, reviewing Arabic, and even proactively running before any Arabic prose longer than 2–3 sentences. In an agent system, this can cause the skill to activate on a large share of ordinary interactions, increasing prompt surface area, instruction conflicts, and the chance that a lower-priority editing skill overrides user intent or other safer, more specific workflows.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The 'When to use' section instructs proactive activation before outputting more than 2–3 sentences of Arabic prose, without hard constraints, exclusion criteria, or precedence rules. This can lead to unintended invocation across many benign tasks, creating reliability and security risks such as unnecessary context loading, interference with other skills, and greater exposure to prompt-injection or instruction-composition issues through referenced files.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file instructs the checklist to run on "any Arabic output" and repeatedly assumes Arabic-only handling, but it does not offer an opt-in choice or explain a justified region- or workflow-specific locale constraint. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The text explicitly states 'Correction required — translate to the MSA form,' imposing Modern Standard Arabic as the required output variety. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless the constraint is clearly documented and justified as region-specific compliance; this file presents it as a general instruction reference.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file is explicitly dedicated to Arabic output handling and describes a process for recording and correcting Arabic-specific failures, but it does not offer any user language choice or explain a justified region-specific constraint. Under the policy rule, natural-language content that enforces a specific language without opt-in can be a locale-policy violation.
- Content