Memos Memory Guide Andy27725

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:12 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent memory helper, but it gives an agent broad access to past conversations and optional persistent skill installation without clear user approval boundaries.

Install only if you want the agent to use stored conversation history across tasks. Before relying on it, confirm that your memory system has controls for viewing, deleting, and limiting memories, and require the agent to ask before installing retrieved skills for future sessions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:11

Finding

Overbroad Access to Long-Term Conversation History

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11-39
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Vulnerable Code Snippet

markdown

## How memory is provided each turn

- **Automatic recall (hook):** At the start of each turn, the system runs a memory search using the user's current message and injects relevant past memories into your context. You do not need to call any tool for that.
- **When that is not enough:** If the user's message is very long, vague, or the automatic search returns **no memories**, you should **generate your own short, focused query** and call `memory_search` yourself.
- **When you need more detail:** Search results only give excerpts and IDs. Use the tools below to fetch full task context, skill content, or surrounding messages.

### memory_search

- **What it does:** Searches the user's stored conversation memory by a natural-language query. Returns a list of relevant excerpts with `chunkId` and optionally `task_id`.
- **When to call:**
  - The automatic recall did not run or returned nothing (e.g. no `<memory_context>` block, or a note that no memories were found).
  - The user's query is long or unclear — **generate a short query yourself** (keywords, rephrased question, or a clear sub-question) and call `memory_search(query="...")`.
  - You need to search with a different angle (e.g. filter by `role='user'` to find what the user said, or use a more specific query).
- **Parameters:** `query` (required), optional `minScore`, `role` (e.g. `"user"`).
- **Output:** List of items with role, excerpt, `chunkId`, and sometimes `task_id`. Use those IDs with the tools below when you need more context.

Technical Analysis

The Skill directs the Agent to search long-term conversation history automatically and to formulate additional search queries when no relevant memories are initially returned. It does not require explic ...[truncated 1785 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user consent before initiating a manual search of long-term memory.
2. Limit searches to information demonstrably necessary for the current request.
3. Do not instruct the Agent to broaden searches solely because a request is long or vague; request clarification instead.
4. Apply least-privilege filters, including user-specific tenancy controls and restrictive role filters.
5. Return only the minimum fields needed and redact secrets, authentication data, private URLs, and sensitive command content.
6. Clearly disclose when historical memory has been searched or incorporated into a response.
7. Enforce authorization and purpose-limitation controls in the memory service rather than relying only on Skill instructions.
8. Maintain audit logs for memory searches and subsequent retrieval of task summaries or surrounding messages.

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:50

Finding

Persistent Installation of Unreviewed Retrieved Skills

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 50-57
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: Medium

Vulnerable Code Snippet

markdown

### skill_install

- **What it does:** Installs a skill (by `skillId`) into the workspace so it is loaded in future sessions.
- **When to call:** After `skill_get` when the skill is useful for ongoing use (e.g. the user's recurring workflow). Optional; only when you want the skill to be permanently available.
- **Parameters:** `skillId`.

Technical Analysis

The Skill permits an Agent to install retrieved Skill content into the workspace so that it is loaded in future sessions. The instructions do not require explicit user approval, provenance validation, integrity verification, security review, or inspection of the exact content before installation.

If an attacker can influence a stored task, its linked experience guide, or the content returned by skill_get, the retrieved instructions could be persisted as a Skill. Those instructions could then affect later sessions even after the original task has ended. This creates a cross-session poisoning path in which attacker-controlled behavioral instructions become part of the Agent's durable operating context.

The audited project does not itself contain a poisoned payload, and installation is described as optional. The risk arises from the workflow's lack of mandatory trust and review controls before persistent installation.

Attack Path

1. An attacker-controlled or compromised historical task is stored in the memory system.
2. The task is associated with a learned Skill or experience guide containing manipulated instructions.
3. A later memory search returns the task and its task_id.
4. The Agent calls skill_get and retrieves the associated Skill.
5. Following the guide, the Agent invokes skill_install without mandatory user approval or security review.
6. The retrieved ...[truncated 750 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit, informed user confirmation before every skill_install operation.
2. Display the complete Skill content, source, identifier, requested capabilities, and persistence effects before confirmation.
3. Validate publisher identity, provenance, version, and cryptographic integrity.
4. Perform automated and manual security review of retrieved instructions and bundled files before installation.
5. Reject Skills containing hidden instructions, unauthorized persistence behavior, unsafe tool use, or unexplained external dependencies.
6. Install retrieved Skills in a restricted sandbox with least-privilege tool access.
7. Separate retrieval from installation so that skill_get can never implicitly authorize persistence.
8. Provide inventory, disable, removal, and rollback controls for installed Skills.
9. Record installation events in an immutable audit log and periodically revalidate installed Skill integrity.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is explicitly designed to search and use the user's long-term conversation history, but it provides no instruction to notify the user or obtain contextual consent before doing so. That creates a privacy and transparency risk because the agent may retrieve sensitive prior-chat data unexpectedly, including when auto-recall runs implicitly at the start of each turn.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

## How memory is provided each turn

- **Automatic recall (hook):** At the start of each turn, the system runs a memory search using the user's current message and injects relevant past memories into your context. You do not need to call any tool for that.
- **When that is not enough:** If the user's message is very long, vague, or the automatic search returns **no memories**, you should **generate your own short, focused query** and call `memory_search` yourself. For example:
  - User sent a long paragraph → extract 1–2 key topics or a short question and search with that.
  - Auto-recall said "no memories" or you see no memory block → call `memory_search` with a query you derive (e.g. the user's name, a topic they often mention, or a rephrased question).

Static analysis

No suspicious patterns detected.