Skill Error Recovery

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:05 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent error-recovery helper, but it asks agents to persist full error details and potentially change agent instruction files without clear user approval or redaction safeguards.

Install only if you are comfortable with an error-recovery skill that may create persistent troubleshooting logs and suggest updates to agent instructions. Before use, require user review for any AGENTS.md or skill/workflow changes, redact secrets and personal data from errors, and avoid saving raw logs that might later be committed or shared.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:132

Finding

Persistent Agent Policy Modification Through Error-Recovery Guidance

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 132-137
Vulnerability Type: Persistent modification of agent instruction state
Risk Level: Medium

Vulnerable Code

markdown

□ Is there a systemic issue?
  → Suggest process improvement
  → Update AGENTS.md if needed

Technical Analysis

The skill directs the agent to update AGENTS.md when it identifies an apparently systemic issue. This file commonly contains persistent workspace-level instructions that affect the behavior of the agent in future tasks or sessions.

The guidance does not require explicit user approval, distinguish trusted observations from attacker-controlled error content, restrict which sections may be modified, or validate proposed instructions before they become persistent. Consequently, information obtained from an untrusted command, repository, tool, or error message could be transformed into a durable behavioral rule.

This is classified as agent memory poisoning because the vulnerable behavior targets persistent agent state rather than merely changing the current response. Exploitation remains conditional on the hosting agent having permission to modify AGENTS.md; the included CLI does not perform this write itself.

Attack Path

1. An attacker controls or influences a repository, command, tool response, or other input processed by the agent.
2. The controlled operation produces a crafted failure or misleading diagnostic context.
3. The error-recovery skill directs the agent to identify a systemic lesson from that failure.
4. Following the instruction to update AGENTS.md, the agent converts the attacker-influenced lesson into a persistent rule.
5. Future agent sessions load the modified instructions.
6. The poisoned rule affects subsequent decisions, tool usage, or security behavior until it is detected and removed.

Impact Assessment

Successful exploitation can obtain persistent influence over a ...[truncated 510 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction to modify AGENTS.md automatically.
2. Require explicit, informed user approval before changing any persistent agent instruction file.
3. Present proposed changes as a reviewable patch that shows the exact content and destination.
4. Never derive persistent instructions directly from raw error messages or other untrusted output.
5. Validate proposals against a strict schema and reject instructions that alter security constraints, permissions, tool policy, or instruction precedence.
6. Store troubleshooting observations in a dedicated non-instructional document rather than AGENTS.md.
7. Record the source and justification for every approved persistent change.
8. Provide an easy rollback mechanism and review existing persistent instructions for unintended changes.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:140

Finding

Unredacted Persistent Storage and Reporting of Complete Error Messages

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 83-89 and 140-149
Vulnerability Type: Sensitive information exposure through error handling and persistent logs
Risk Level: Medium

Vulnerable Code

markdown

**Report format:**

⚠️ Error encountered: [brief description]

What happened: [What I was doing]

Error details: [Full error message]

text

```markdown
**Error log:**

memory/errors/YYYY-MM-DD.md

[Error Type] - [Timestamp]

Context: What I was doing Error: Full error message Cause: Root cause (if known) Fix: How I resolved it Prevention: How to avoid in future

text

The persistent logging behavior is also described in README.md, lines 109-116.

Technical Analysis

The skill requires the agent to include the complete error message in reports and persist it under memory/errors/. It does not require redaction, data classification, user consent, restrictive file permissions, retention limits, output-size limits, or repository exclusion.

Error messages can contain authorization headers, API tokens, credential-bearing URLs, cookies, request bodies, personal information, environment values, internal hostnames, and sensitive local paths. Copying complete messages into durable workspace files converts transient diagnostic exposure into persistent plaintext exposure.

The project does not implement network transmission or automatic repository commits. Exploitation therefore depends on a later disclosure channel, such as source-control commits, workspace synchronization, backups, artifact collection, or access by another process or agent.

Attack Path

1. A command, API, or application fails while processing sensitive data.
2. Its error output includes a token, credential, private URL, personal data, or another confidential value.
3. The skill instructs the agent to reproduce the full error in its report.
4. The skill also direct ...[truncated 905 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace “Full error message” with a sanitized diagnostic summary by default.
2. Redact authorization headers, cookies, API keys, tokens, passwords, private keys, credential-bearing URLs, query secrets, personal data, and sensitive filesystem paths.
3. Apply redaction before both user-facing reporting and persistent storage.
4. Use allowlisted diagnostic fields instead of attempting only pattern-based secret removal.
5. Require explicit user consent before persisting detailed error information.
6. Enforce restrictive permissions on diagnostic files and exclude memory/errors/ from source control and published artifacts.
7. Define retention limits and provide automatic deletion or rotation.
8. Limit message size to prevent oversized or attacker-controlled output from being stored.
9. Store hashes or references to sensitive values when correlation is necessary.
10. Warn users that even sanitized diagnostic logs must be reviewed before sharing or committing them.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The instruction to 'Update skill/workflow' encourages self-modification of agent behavior after encountering errors, but it does not require human review, change control, or scope limits. An agent that can alter its own prompts, skills, or workflow definitions based on runtime events may introduce persistence, broaden capabilities, or codify bad recovery logic into future runs.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md

□ Could this happen again?
  → Add guard for this case
  → Update skill/workflow

□ Is there a systemic issue?
  → Suggest process improvement

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 18)May include surrounding context.

md

| 🤫 **Silent failure** | Error occurs, agent says "Done!" | Broken state, user doesn't know |
| 🔄 **Blind retry** | Same call, same params, same error | Wasted tokens, rate limits hit |
| 🔥 **Error escalation** | Wrong fix makes it worse | Data loss, cascading failures |
| 📉 **Fake success** | "Should work" without verification | Delivery of broken results |

**Sound familiar?** You ask an AI agent to fix a file, it says "Done!" — but nothing changed.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

| 🤫 **Silent failure** | Error occurs, agent says "Done!" | Broken state, user doesn't know |
| 🔄 **Blind retry** | Same call, same params, same error | Wasted tokens, rate limits hit |
| 🔥 **Error escalation** | Wrong fix makes it worse | Data loss, cascading failures |
| 📉 **Fake success** | "Should work" without verification | Delivery of broken results |

**Sound familiar?** You ask an AI agent to fix a file, it says "Done!" — but nothing changed.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly promotes persistent logging of errors to memory/errors/ and lists root cause analysis and fix documentation, but it does not mention redaction, minimization, retention limits, or access controls. Error payloads often contain secrets, tokens, file paths, stack traces, prompts, or user data, so storing them by default can create a secondary data exposure risk even if the original error handling goal is benign.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger condition in the metadata uses very common words like 'error', 'failed', and 'retry', which can cause the skill to activate in many ordinary conversations or unrelated contexts. Overbroad activation increases the chance the skill changes agent behavior unexpectedly, including interrupting workflows or applying recovery actions where they are not appropriate.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example contradicts the earlier rule that authentication errors should not be auto-retried and instead require human action. In practice, telling an agent it 'will try using token auth' after a credential failure can normalize autonomous credential-handling behavior, which may lead to unsafe secret use, unexpected auth flows, or policy bypasses.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The listed trigger phrases are ambiguous and common in normal dialogue, making accidental invocation likely. If the skill activates too easily, it can alter agent decision-making, retry behavior, or reporting flow in situations that do not warrant recovery logic.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code file contains natural-language strings that force Chinese for the title, usage, diagnostics, and help output. Under the policy, a skill should not impose a specific language unless the user is given an opt-in choice or the locale restriction is clearly justified.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/error-diagnose.mjs (reported line 26)May include surrounding context.

js

quickFix: '检查chmod权限，或尝试sudo',
    suggestions: [
      '检查文件权限: ls -la',
      '修改权限: chmod 644/600',
      '切换到正确用户组',
      '使用sudo（慎用）'
    ]

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The file adds Chinese trigger phrases alongside English ones, but does not explain whether multilingual behavior is intentional, user-selectable, or scoped to a locale. This can create an undocumented language-policy behavior because the skill's language handling is implicit rather than clearly offered as an opt-in or justified locale feature.

Content

No source excerpt is available for this finding.