Security audit

Apm Agent Progressive Memory

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed memory-management system, but its own hook code can automatically expose private DM memory in group sessions when chat mapping or detection fails.

Review carefully before installing in any workspace with private notes or group chats. Use it only if you are comfortable with automatic memory bootstrap and persistence, and avoid group use until the DM fallback and flush-state separation are fixed to fail closed.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: hooks/apm_session_start/handler.js:357
Finding: Fail-Open Group Detection Injects Private DM Memory into Group Sessions
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: hooks/apm_session_start/handler.js:184
Finding: Untrusted Persistent Memory Is Promoted into Agent Bootstrap Instructions
Content: View full analysis
Auto-injected by apm_session_start hook at ${new Date().toISOString()}`); out.push(`> Chat type: direct | Loaded per APM 1.6.0 protocol (memory/main/index.md L0 entry gate)`); out.push(`> Workspace: ${workspaceDir}`); out.push(''); out.push(`## L0 — Routing Index (memory/main/index.md)`); out.push(indexContent.trim()); out.push(''); if (attention) { out.push(`## P0 — Attention (active tasks / blockers)`); out.push(attention.trim()); out.push(''); } if (longterm) { out.push(`## P1 — Longterm (distilled MEMORY.md summary)`); out.push(longterm.trim()); out.push(''); } if (dailySynced) { out.push(`## P2 — Daily Synced`); out.push(dailySynced.trim()); out.push(''); } if (todayNote) { out.push(`## Daily — Today (${todayStr})`); out.push(todayNote.trim()); out.push(''); } if (yesterdayNote) { out.push(`## Daily — Yesterday (${yesterdayStr})`); out.push(yesterdayNote.trim()); out.push(''); } ``` The composed text is promoted into bootstrap context at `hooks/apm_session_start/handler.js:413-425`: ```js // Idempotency — already injected this session const alreadyInjected = context.bootstrapFiles.some( (file) => file && file.name === entryName ); if (alreadyInjected) { return; } context.bootstrapFiles.push({ name: entryName, path: contentPath, content: entryContent, missing: false, }); ``` The persistence rules that can populate these files appear in `SKILL.md:64-66`: ```markdown ### 4. Write-Back on Updates - New decision → append to `experience.md` - Task status change → update `attention.md` - Index files: append-only (mark deleted entries `[DEPRECATED]` instead of removing) ``` ### Technical Analysis The Skill instructs the agent to persis ...[truncated 2850 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: hooks/remem-flush/handler.js:119
Finding: Flush Hooks Mix Group Metadata into the DM-Only State File
Content: View full analysis
new Date(lastFlush)) { deltas.push({ group, file: fileName, path: filePath, mtime: mtime.toISOString() }); } } } const newState = { last_flush_time: new Date().toISOString(), context_usage_at_flush: contextUsage, session_id: sessionId, groups_found: groups.length, deltas_detected: deltas.length, deltas: deltas.slice(0, 10), ...Object.fromEntries( Object.entries(oldState).filter(([k]) => k.endsWith('_mtime')) ) }; for (const delta of deltas) { newState[`${delta.group}/${delta.file}_mtime`] = delta.mtime; } writeJSON(flushStatePath, newState); ``` The pre-compaction handler repeats the same design in `hooks/pr ...[truncated 3534 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: ADDENDUM.md:5
Finding: Memory Templates Encourage Plaintext Storage of Sensitive Infrastructure Information
Content: View full analysis
⚠️ This file only stores **high-level identity + index**. > Project details go to `memory/main/projects/`. > Event logs go to `memory/YYYY-MM-DD.md`. ## Identity - **Me**: {agent name}, {role}, {style} - **Principles**: {3-5 max} ## User - **Name**: {user name} / {aliases} - **Timezone**: {tz} - **Stack**: {languages/tools} ## Servers - **Host**: {hostname} - **Access**: {ssh/sftp url} ## Key Databases - **{db name}**: {path} ## Project Index (see `memory/main/projects/`) | Project | Path | Detail File | |---------|------|-------------| | {name} | {path} | `projects/{name}.md` | | ... | ... | ... | ## Other Memory Entries - Current tasks: `memory/main/attention.md` - Experience index: `memory/main/longterm.md` - Daily logs: `memory/YYYY-MM-DD.md` - Group chats: `memory/groups/` (APM 5-step) - DVC / data: {path} ``` ``` The policy in `SKILL.md:142-150` reinforces this storage practice: ```markdown | Category | Example | Reason | |----------|---------|--------| | Identity | Agent self-reference (role, style, principles) | Self-reference, stable | | User basics | Name, timezone, tech stack | Rarely changes | | Environment | Server host, key DB paths | Constants | | Project index | One-liner per project → file | Pointer, not content | | Other memory entry pointers | `memory/main/...`, `memory/groups/...` | Routing only | ``` ### Technical Analysis The supplied authoritative memory template directs operators and agents to persist user identity data, hostnames, SSH/SFTP access URLs, database locations, project paths, and data-storage paths in plaintext Markdown. The project does not provide corresponding safeguards such ...[truncated 2170 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (20)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This document defines behavior that intercepts commands, handles system-style events, and reads/writes memory and flush-state files, but those capabilities are not transparently declared in the skill description. In practice, that means a seemingly benign 'memory protocol' can act like a stateful hook with filesystem side effects, which expands its authority and can surprise users or integrators.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This document defines behavior that intercepts commands, handles system-style events, and reads/writes memory and flush-state files, but those capabilities are not transparently declared in the skill description. In practice, that means a seemingly benign 'memory protocol' can act like a stateful hook with filesystem side effects, which expands its authority and can surprise users or integrators.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation defines a strict privacy boundary for group chats, yet elsewhere allows unresolved group sessions to fall back to DM memory. That creates a direct path for private DM-only memory to be exposed in a group context when configuration is incomplete or detection fails. In a memory bootstrap hook, this is especially dangerous because disclosure happens automatically at session start.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file documents contradictory safety behavior: one section says missing group state results in no injection, while another says unresolved groups fall back to DM protocol. Contradictions in security-critical routing rules often lead to unsafe implementations, operator misunderstanding, and accidental disclosure of private memory into shared chats. Because this hook governs bootstrap context, any mistake propagates sensitive content before users can intervene.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This fallback semantically authorizes cross-scope data flow from private DM memory into a group-chat session when group mapping is missing. That violates least privilege and session isolation, and could expose personal notes, prior direct-message context, or other sensitive memory to unintended participants. In an agent memory bootstrap mechanism, the leak is automatic and repeatable.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The limitation explicitly accepts a condition where DM-only memory remains injected into group sessions and depends on the agent not to use it. That is not a valid isolation control: the sensitive content is already inside the model context and may influence outputs even if the agent is instructed not to read it. Given this skill's purpose—memory injection by chat type—the mismatch makes the issue more dangerous, not less.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: When a group chat is detected but no group-name mapping exists, the handler intentionally falls back to composeApmContext(), which loads DM-only memory from memory/main/* and daily notes. That directly violates the file’s own privacy boundary comments and can disclose private direct-message context into a group session visible to multiple participants.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The fallback exposes sensitive DM memory to a group session while only emitting console warnings to operators; there is no technical safeguard preventing disclosure to end users in the group. Because bootstrapFiles are injected into the active session context, the leak occurs automatically and silently from the participants’ perspective.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code comments explicitly acknowledge that the fallback is 'NOT RECOMMENDED' and that 'private memory may leak into group chat,' yet the implementation still performs the unsafe action. This is strong evidence of a knowingly unsafe privacy boundary bypass, making accidental disclosure highly plausible in routine misconfiguration scenarios.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: A missing group mapping causes the handler to treat a known group session as if it were a DM session, loading private memory that was meant to stay isolated. In this skill context, that is especially dangerous because the entire component is a memory bootstrapper, so misrouting directly changes what confidential context the agent is given in a multi-user environment.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Unknown session keys default to the DM protocol, so any future platform change, parser mismatch, or malformed session identifier can cause a non-DM chat to receive DM-only memory. Because this hook runs at bootstrap, the misclassification happens before any later guardrails can correct it, creating a broad confidentiality risk.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The addendum states that 'MEMORY.md is the authoritative original' and 'stays completely unchanged,' and later says 'MEMORY.md: do not touch.' But the same document instructs users to detect matches in MEMORY.md and move content out of it, and refers to distilling MEMORY.md updates on each flush. That creates an intent-level contradiction in the documentation about whether MEMORY.md is immutable or subject to restructuring.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Lines L51-L53 say non-English references were translated to English 'to keep the skill monolingual.' This is natural-language evidence of an English-only policy, and the file does not mention user opt-in or a documented regional/compliance justification for restricting language.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill instructs the agent to automatically flush memory and create missing memory files, but it does not provide a clear user-facing warning that conversations may be persisted or that files may be modified without an immediate explicit prompt. This is dangerous because it can lead to unexpected retention of sensitive chat content, privacy boundary violations, or silent creation of durable records from transient interactions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documented fallback permits DM memory in group or unknown sessions and does not make that behavior a hard error or prohibited state. Even if labeled 'not recommended,' it normalizes an unsafe configuration path that can leak sensitive memory across conversation boundaries. The skill context increases risk because the feature is explicitly about privacy-sensitive memory scoping.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The limitation acknowledges that group sessions may still receive MEMORY.md and relies on a DO-NOT-READ instruction plus agent obedience. Security controls based on model compliance are not reliable barriers; once sensitive DM memory is injected into group context, it may be summarized, quoted, or acted upon despite warnings. This is a real privacy weakness because the hook admits known leakage conditions without enforcing technical containment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The hook explicitly supports cron-triggered /remem via system:event and documents that it writes memory/flush-state.json on every flush, meaning state can be changed without an interactive user action at the time of execution. In a memory/privacy-oriented skill, undisclosed automatic writes increase the risk of unexpected persistence, audit confusion, and cross-context state changes, especially given the noted DM/group flush-state sharing limitation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The hook persists session metadata including session_id, context usage, flush timing, group counts, and recent file-change deltas to disk without any visible notice, consent, minimization, or retention control. In a memory-management skill, this creates a real privacy and data-governance risk because operational metadata about user sessions and memory activity is silently accumulated and could later be accessed by other local components, operators, or attackers with filesystem access.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The manifest describes a progressive memory protocol for group chat and DM memory, but this addendum embeds a bash-based grep workflow for auditing and extracting MEMORY.md contents. While documentation may include maintenance guidance, prescribing shell command execution is not an obvious requirement of the stated memory-disclosure purpose itself.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example 06:17 / 18:17 Asia/Shanghai embeds a specific timezone/locale in natural-language documentation. The file does not indicate that this timezone is configurable, user-selected, or required for a region-specific purpose, which can conflict with language/locale neutrality expectations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.