Coding Guidelines

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:55 AM UTC
• Version: 1.0.0

Overview

This coding-guidance skill is mostly plain advice, but it tells the agent to always consult persistent user memory without clear consent or limits.

Review this skill before installing if you use persistent agent memory. Its coding advice is generally ordinary, but it may cause the agent to consult stored personal preferences or other cross-session memory during routine coding tasks. Install only if you are comfortable with that access, or edit the skill to require explicit consent and task relevance before reading memory.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:74

Finding

Overbroad Access to Persistent User Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 74
Vulnerability Type: Least-privilege violation through unnecessary persistent-memory access
Risk Level: Medium

Complete Code Snippet:

md

- Things the user has strong opinions about (check MEMORY.md / friend memory)

Technical Analysis

The Skill designates persistent memory as context that should always be included in coding tasks. It does not require explicit user consent, establish a task-relevance test, or restrict which memory entries may be retrieved.

Routine coding assistance generally requires only the current request, relevant repository files, tests, and project-local conventions. Persistent memory may contain unrelated preferences, conversation-derived facts, or sensitive cross-session information. Automatically consulting it therefore exceeds the minimum privileges needed for the Skill's declared functionality.

This is an access-scope issue rather than memory poisoning: the audited instruction reads persistent state but does not write attacker-controlled instructions to it. The audit found no instruction to transmit retrieved memory over a network.

Attack Path

1. A user submits an ordinary coding, debugging, refactoring, or review request that activates the Skill.
2. The agent follows the “Context to always include” instruction.
3. The agent opens MEMORY.md or accesses “friend memory” without obtaining specific consent.
4. Unrelated persistent information enters the active context.
5. That information may influence generated code or plans, or may be repeated in responses and artifacts visible to the current session.

Impact Assessment

The instruction can grant the active agent read access to persistent, cross-session user information beyond the repository and current request. The affected scope depends on the contents and access controls of the memory source, but may include unrelated personal preferences, histori ...[truncated 351 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove persistent memory from the context that is “always” included.
2. Use the current request, repository-local documentation, tests, and existing code patterns as the default context sources.
3. Require explicit, informed user consent before accessing any persistent memory.
4. Retrieve only entries directly relevant to the current task rather than loading an entire memory file or store.
5. Prevent retrieved memory from being copied into code, logs, plans, commits, or responses unless necessary and expressly authorized.
6. Document the memory source, purpose, scope, and retention behavior before access.
7. Replace the affected instruction with least-privilege wording such as:

   md

   Use preferences explicitly supplied in the current request. Access persistent
   memory only with the user's explicit consent and retrieve only entries directly
   relevant to the current task.
   

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest description says the skill applies when the user asks for help writing, refactoring, debugging, architecting code, or using AI coding tools effectively, and further says it 'Triggers on coding tasks, code reviews, architecture discussions, and requests involving AI coding workflows.' This scope is very broad and lacks concrete exclusion conditions or negative examples, increasing the chance of unintended invocation across common programming conversations.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/context-engineering.md:22