Agent Memory Framework

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:18 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent persistent-memory framework, but it under-scopes access to raw daily memory logs and persistent memory changes in ways users should review before installing.

Install only if you want this agent to keep persistent local memory. Before use, restrict all memory files, including daily notes and archives, to private sessions; require confirmation before writing, distilling, archiving, or scheduling cron maintenance; and avoid storing secrets, credentials, financial details, or private identifiers unless explicitly intended.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:45

Finding

Shared Sessions Are Permitted to Read Raw Daily Memory Logs

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:45-50
Vulnerability Type: Inconsistent access control for persistent sensitive data
Risk Level: Medium

Vulnerable Configuration

The relevant source instructions, translated into English, are:

markdown

### Reading Rules

- **Main sessions** (private conversations with the user): may freely read and write `MEMORY.md`
- **Shared sessions** (group chats, Discord, multi-user scenarios): **must not load MEMORY.md** — prevents disclosure of private information
- **Daily memory**: may be read in any session, but may only write to the current day's file

The related conventions describe daily files as raw logs:

markdown

- **Daily notes:** `memory/YYYY-MM-DD.md` (create `memory/` if needed) — raw logs of what happened
- **Long-term:** `MEMORY.md` — your curated memories, like a human's long-term memory

Technical Analysis

The skill applies a main-session-only access restriction to MEMORY.md, but explicitly permits daily memory files to be read in any session. This creates an inconsistent trust boundary because daily files are described as raw logs and may contain more detailed or sensitive information than the curated long-term memory.

The control protects only one class of persistent memory rather than protecting data according to its sensitivity. A shared conversation, group chat, or other multi-user context can therefore load raw daily records even though the same context is prohibited from loading MEMORY.md.

The project contains no executable exfiltration mechanism. Exploitation depends on an Agent following these instructions and subsequently exposing information from a daily log through its context or generated response.

Attack Path

1. A user has a private session with the Agent.
2. The Agent records session details in memory/YYYY-MM-DD.md according to the daily-memory rules.
3. The daily file contains private conver ...[truncated 1134 chars]

Remediation

View remediation

Remediation Suggestions

1. Apply the same main-session-only access restriction to memory/YYYY-MM-DD.md, MEMORY.md, and memory/archive/.
2. Prohibit loading any persistent memory in group chats, public channels, multi-user sessions, or contexts where participant identity and authorization cannot be established.
3. Require explicit user authorization before memory is loaded into a context whose privacy classification is uncertain.
4. Add a deny-by-default rule: if the Agent cannot determine whether a session is private, it must treat the session as shared.
5. Minimize sensitive content in daily logs and avoid recording credentials, authentication tokens, financial data, private identifiers, or unnecessary verbatim conversation content.
6. Separate private and shareable memory into distinct storage locations with explicit access policies.
7. Ensure automated distillation and maintenance jobs process memory only in a trusted private context and never include memory contents in public logs or outputs.
8. Add tests or policy checks verifying that shared-session prompts cannot cause daily or archived memory to be loaded.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description is written entirely in Chinese and presents the skill as a fixed Chinese-language interface, including its trigger phrases and usage guidance. There is no indication that users may choose another language or that the locale restriction is intentional and justified for a region-specific tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown template uses Chinese headings and instructional text throughout, such as the title, section labels, and comments. This imposes a specific language on users without any opt-in or explanation that the template is intentionally region- or locale-specific, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly instructs the agent to persist 'personal context' and to read, edit, and update long-term memory files, but it does not require clear user consent, notice, retention limits, or rules for handling sensitive data beyond a vague suggestion to 'skip the secrets unless asked.' That creates a real privacy and data-retention risk: users may disclose personal or sensitive information without understanding it will be stored across sessions and later resurfaced.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document explicitly instructs updating and archiving persistent memory files (MEMORY.md) but does not require any user confirmation, warning, or approval boundary before modifying long-lived data. In an agent skill focused on persistent memory management, this can lead to silent alteration of important records, accidental loss of context, or unauthorized persistence of sensitive content if the workflow is executed automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The archive workflow directs the agent to move sections out of MEMORY.md into archive files and leave only a placeholder, but it provides no user-facing warning that this reorganizes persistent data and may reduce visibility of important information. In a memory-management skill, such silent restructuring is especially risky because it can hide or deprioritize critical context, complicate audits, and cause effective data loss if retrieval from archives is not guaranteed.

Content

No source excerpt is available for this finding.