T02 · Agent Memory Poisoning
Warning
- Location
references/spec.md:7- Finding
Unfiltered Command Output Is Persisted in Long-Term Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
Daily Log
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent daily journal writer, but it stores command output in persistent memory without clear redaction, confirmation, or deletion controls.
Install only if you are comfortable with the agent keeping persistent daily logs. Avoid using it after commands that print tokens, credentials, private configuration, customer data, or other sensitive output unless you first add a redaction and deletion policy.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The description says the skill triggers '每次会话结束前或完成重要任务后', which is an ambiguous condition rather than a narrowly scoped invocation phrase. Terms like '会话结束前' and especially '重要任务后' are subjective and provide no exclusion conditions or concrete trigger boundaries, increasing the chance of unintended invocation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The listed triggers include '会话结束前', '完成重要任务后', and '用户明确要求时', but only the last is clearly bounded by user intent. The first two are open-ended operational cues without constraints or negative examples, so an agent may invoke the skill too frequently or inconsistently.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md - **memory-review** 负责扫描日记生成知识提案 - 两者配合：详细日记 → 更多可提取知识 详见 `skills/memory-review/SKILL.md`
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The entire specification is written as a mandatory Chinese-only logging format and does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the regional constraint is explicitly justified.
- Content