T02 · Agent Memory Poisoning
Warning
- Location
scripts/emotion-tag.py:211- Finding
Persistent Prompt Injection Through Unsanitized Emotional Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
Emotional Memory
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed local emotional-memory system, but it persistently stores sensitive conversation-derived memories and encourages loading them into future agent sessions without enough privacy or prompt-injection controls.
Review before installing. Use this only with explicit user consent, keep the memory directory private, avoid storing raw secrets or intimate personal details, add deletion and retention rules, and make sure any loaded self-model or memory report is treated as untrusted reference data rather than instructions.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The code does partially match the 'tag emotional moments' part of the description: it logs emotional memories, assigns weights, tags, associations, and emotional dimensions, and supports retrieval and summary views. However, the broader declared purpose claims emotional continuity through overnight consolidation and evolution of a self-model, and those capabilities are not present in this code chunk. There is no scheduler, consolidation routine, summarization pass, self-model update logic, or cross-session reasoning beyond file-based persistence. In addition, the implementation is explicitly a persistent JSONL-backed index with search and stats operations, which materially resembles a database/index despite the description's claim 'Not a database.' Therefore the description overstates and partially mischaracterizes the actual behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README explicitly encourages storing and replaying emotionally weighted memories derived from conversations, including examples involving trust, mistakes, and personal disclosures, but it does not warn that this can persist sensitive user data locally across sessions. In the context of an agent skill, this is risky because operators may deploy it as written, enabling long-lived retention of intimate or confidential content without consent, minimization, or access-control guidance.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill declares executable behaviors and implies file/env access but does not specify any explicit tool scope or permission boundaries. In agent environments, missing scope declarations can cause the skill to inherit broader-than-necessary capabilities, increasing the blast radius if the skill is invoked or modified unexpectedly.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs persistent storage of emotionally significant conversation content, which is likely to include sensitive personal data, without any consent, retention, minimization, or privacy warning. Emotional summaries and tags can capture intimate user information that may later be read, leaked, or repurposed across sessions.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Persisting emotionally significant user interaction details across sessions creates a cross-session data retention channel in natural language. That materially increases the risk of unintended disclosure, prompt-context leakage, profiling, and resurfacing one user's sensitive information in later interactions.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The AGENTS.md integration guidance explicitly tells the agent to search stored memories before responding and load a self-model at session start, which operationalizes reuse of prior conversational data. In context, this makes leakage more likely because recalled memories can influence responses even when the current user did not authorize access to prior session-derived content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script persists conversation-derived emotional summaries, moods, tags, and associations to a local JSONL file without any user-facing warning, consent flow, retention notice, or protection mechanism. In the context of an 'emotional memory' skill, this data is especially sensitive because it can reveal intimate psychological state, relationship details, and longitudinal behavioral patterns if another local user, process, backup system, or support workflow accesses the file.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script persists a generated self-model document derived from emotional memories to disk automatically, without any consent, warning, minimization, or access-control mechanism. Because the stored content includes sensitive emotional patterns, lessons, anxieties, and continuity assessments, local disclosure, unintended syncing, or later reuse by other tools could expose highly sensitive behavioral data.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script appends continuity history records to a persistent JSONL log without notifying the user that identity-scoring history is retained over time. Even though the log is less descriptive than the markdown self-model, it still accumulates longitudinal behavioral metadata that could reveal trends, drift events, and usage history if accessed by unauthorized parties.
- Content
Static analysis
No suspicious patterns detected.