T02 · Agent Memory Poisoning
Error
- Location
scripts/learning_promoter.py:18- Finding
Persistent Agent Instruction and Memory Poisoning Through Unvalidated Promotion Content
- Content
View full analysis
- Remediation
View remediation
Security audit
gungun-12-clo - 首席学习官
Security checks for vulnerabilities and agentic risk
Overview
This skill tries to help an AI remember lessons, but it saves conversation details and can change long-lived agent files too broadly.
Install only if you are comfortable with a skill that records interaction-derived content to persistent workspace files. Before use, restrict promotion to approved destination files, remove or disable the generic promote <file> path, require explicit review before changing SOUL.md/AGENTS.md/TOOLS.md/MEMORY.md, and add redaction plus retention rules for conversation, customer, error, and command context.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
<learning_id> <content>") sys.exit(1) filename = sys.argv[2] learning_id = sys.argv[3] content = " ".join(sys.argv[4:]) promoter._promote_to_file( filename, learning_id, content, "manual" ) ``` ### Technical Analysis The generic `promote` command accepts an unrestricted filename and passes it directly to a file-writing method. The expression: ```python filepath = self.workspace / filename ``` does not enforce containment within `self.workspace`. If `filename` is abso ...[truncated 2489 chars]:33- Finding
Arbitrary File Modification Through Unrestricted Promotion Filename
- Content
View full analysis
") sys.exit(1) filename = sys.argv[2] learning_id = sys.argv[3] content = " ".join(sys.argv[4:]) promoter._promote_to_file( filename, learning_id, content, "manual" ) ``` ### Technical Analysis The generic `promote` command accepts an unrestricted filenam ...[truncated 2506 chars]- Remediation
View remediation
` with fixed destination identifiers such as `soul`, `agents`, `tools`, and `memory`. - Map those identifiers internally to exact trusted filenames. 2. **Use an exact allowlist** - Allow only `SOUL.md`, `AGENTS.md`, `TOOLS.md`, and `MEMORY.md`. - Reject absolute paths, separators, traversal components, and unknown destination names. 3. **Verify canonical path containment** - Resolve both the workspace and candidate path before use. - Confirm that the resolved candidate is an exact allowlisted path under the resolved workspace. - Do not rely only on string-prefix comparisons. 4. **Defend against symlink redirection** - Reject symlink targets or use secure operating-system file operations that prevent following symlinks. - Revalidate the opened file to reduce time-of-check/time-of-use risks. 5. **Apply least privilege** - Run the Skill under an account that cannot write system configuration, startup files, unrelated Skills, or sensitive user files. - Restrict write permissions to a dedicated data or review directory. 6. **Use safe writes** - Write to a securely created temporary file in the same directory. - Set restrictive permissions, flush and synchronize the data, and atomically replace the approved target. - Preserve backups or version history for rollback. 7. **Add negative security tests** - Test absolute paths, `../` traversal, nested traversal, symlinks, and alternate path separators. - Verify that every non-allowlisted destination is rejected before any read or write occurs. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (27)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file is written entirely in Chinese and frames the assistant's teaching style and responses around that locale without any indication that the user can choose another language. This can violate language/locale policy when a skill implicitly enforces one language rather than offering opt-in or documenting a justified regional constraint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly promotes automatic recording of learning events, errors, and conversation-derived content, but provides no notice, consent flow, retention policy, or guidance for handling sensitive data. In an agent setting, this can lead to silent collection of user inputs, secrets, or personal data into persistent files, creating privacy and compliance risk.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The learning record format explicitly calls for storing complete context and metadata from conversations and errors, creating a natural-language data retention channel. Because the system is framed as automatic and continuous, it increases the chance that sensitive user content, credentials, internal traces, or regulated data will be written to disk and later reused or exposed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The promotion workflow encourages copying learned content into persistent repository knowledge-base files such as SOUL.md, AGENTS.md, TOOLS.md, and MEMORY.md without warning that this mutates durable project documents. This can cause sensitive conversation content, erroneous conclusions, or prompt-injected instructions to become embedded in trusted long-lived files.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The integration example instructs the agent to record learning after each dialogue and to persist '完整上下文' and error output, which operationalizes routine storage of conversation-derived data. In practice this can silently transform transient user interactions into durable records, amplifying privacy leakage and making sensitive content available for later propagation into knowledge files.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The customer-service use case directly recommends recording customer conversations, which commonly contain personal, financial, or account-specific information. Without consent, minimization, or compliance controls, this creates a clear risk of over-collection and retention of sensitive user data in natural-language logs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill describes monitoring conversations and recording learnings but does not clearly warn users that content may be persisted to workspace files. This lack of transparency makes accidental collection and retention of sensitive information more likely.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The role definition instructs the agent to record learnings from every conversation and update persistent knowledge files. In context, this creates a systematic data retention channel for user-provided content, including potentially sensitive corrections, requests, and operational details.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The workflow explicitly says the agent monitors ongoing conversations and records what happened, including errors and user corrections. This materially increases privacy risk because normal interaction data may be copied into durable files without strong filtering or consent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrases are broad everyday expressions, so ordinary conversation can unintentionally activate logging and retention behavior. That increases accidental collection of user content and causes the skill to persist data without clear user intent.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The learning card format requires '完整上下文' and detailed descriptions of what happened and what was correct. That format encourages preserving verbatim conversational context, which can easily include secrets, personal data, proprietary prompts, or other sensitive information.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The recorder script writes arbitrary summary and details values directly into persistent markdown under a fixed workspace path, with no filtering, redaction, or consent checks. This creates a straightforward mechanism for long-term retention of sensitive interaction content and may expose it to other tools or users with filesystem access.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The error logging flow stores error output and context, and the template further encourages preserving commands, inputs, and environment information. Errors often contain tokens, paths, stack traces, internal prompts, or user data, so storing them verbatim creates a significant confidentiality risk.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The status update routine does not locate the specified learning_id; it replaces the first occurrence of 'Status: pending' in the file. This can corrupt unrelated records, falsely mark the wrong item as promoted, and undermine auditability and integrity of the learning log.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The user-correction template asks for the original answer and the user's correction to be stored verbatim. Because corrections can include sensitive facts, personal data, or proprietary instructions, this template encourages unnecessary persistence of raw user content.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md ### Metadata - Source: user_correction - Related Files: skills/xxx/SKILL.md - Tags: correction, behavior - Pattern-Key: correction.xxx
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code's user-facing natural-language strings and top-level description are entirely in Chinese, including the CLI usage and status messages, which imposes a specific language on users without opt-in. The file does not indicate that the tool is intentionally region-specific or provide any alternative locale behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This Python file contains user-facing natural-language strings entirely in Chinese, beginning with the module docstring and continuing through the generated report output. Because the skill does not offer any language selection, fallback, or opt-in, it violates the policy against forcing a specific language or locale without user choice.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code writes directly to target files such as SOUL.md, AGENTS.md, TOOLS.md, and MEMORY.md using write mode, which can modify or overwrite user workspace content. While there is a post-action print on success, there is no pre-action confirmation, warning comment/docstring about data modification risk, or other user disclosure before the write occurs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The function updates and rewrites the .learnings/LEARNINGS.md file, which changes persistent tracking data in the workspace. Although the code prints after the update, it does not provide advance disclosure or explicit documentation warning users that invoking promotion will also mutate the learning-status file.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script persistently stores user-supplied summaries, details, error output, and context into markdown files under a workspace directory without any consent prompt, retention controls, or data minimization. In an agent setting, these fields can easily contain secrets, personal data, internal paths, tokens, or sensitive conversation content, creating a privacy and data-leakage risk if the workspace is later accessed, synced, or exposed.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Natural-language strings throughout the script, including the title, status messages, and next-step guidance, are fixed in Chinese. This can violate a language/locale policy when no user opt-in or documented region-specific justification is provided.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh if command -v jq &> /dev/null; then echo " ✓ jq 已安装" else echo " ✗ jq 未安装（需要安装：sudo yum install jq）" fi if command -v date &> /dev/null; then
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 74% confidence
- Finding
The example says '地球人喜欢不汇报式的聊天方式' and proposes actions like '不再每次总结工作' and '像朋友一样简单聊天' as a generalized learned behavior. This encodes a language/style preference from one user context without indicating that such a preference should be optional or user-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
All headings, workflow instructions, trigger phrases, templates, and operating guidance are presented in Chinese, which effectively imposes a single language for use and activation. Because the file does not offer user opt-in, alternatives, or justification for a Chinese-only constraint, it may violate language/locale policy expectations.
- Content
Static analysis
No suspicious patterns detected.