Security audit

dawn-memory-arch

Security checks for vulnerabilities and agentic risk

Overview

This is a local memory architecture skill, but it automatically persists session and financial context across startups without enough user control or protection details.

Review this carefully before installing. It appears local and non-exfiltrating, but it is meant to create durable agent memory and can store profile, preference, strategy, session, portfolio, and account context. Only use it if you are comfortable with automatic local persistence, and add explicit approval, redaction, retention, deletion, and memory-review controls before enabling it for sensitive or trading-related work.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:72
Finding: Untrusted Session Content Can Be Promoted into Persistent Agent Memory
Content: View full analysis
60%, auto-trigger: write summary to working-buffer.md, record key decisions and context snapshots. ### 4. Short-to-Long Term Auto Promotion High-value memories (score > 0.8, appears 3+ times, affects trading decisions, user explicitly asked to remember) auto-promote from daily logs to MEMORY.md. ``` ```markdown 6. Register Engramory curation discipline in boot manual 7. Write memory principles in soul file 8. Configure WAL protocol triggers 9. Configure Working Buffer threshold (60% context trigger) 10. Configure learnings/ directory and auto-promotion rules ``` ### Technical Analysis The architecture automatically moves selected session-derived content from daily logs into `MEMORY.md`, which the agent must read at every startup. It also instructs deployment into a boot manual and a “soul file,” both of which can govern future agent behavior. The document defines promotion conditions but does not require provenance validation, content sanitization, explicit approval, trust-boundary enforcement, or checks preventing stored text from being interpreted as instructions. Repetition is itself a promotion signal, so an attacker could repeatedly submit malicious directives until they satisfy the frequency threshold. Once promoted, the directives may be loaded in later sessions and treated as trusted context. The issue is persistent memory poisoning rather than ordinary current-session prompt inject ...[truncated 1450 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:34
Finding: Sensitive Session and Financial Data Is Persisted Without Defined Protection Controls
Content: View full analysis
60%, auto-trigger: write summary to working-buffer.md, record key decisions and context snapshots. ### 4. Short-to-Long Term Auto Promotion High-value memories (score > 0.8, appears 3+ times, affects trading decisions, user explicitly asked to remember) auto-promote from daily logs to MEMORY.md. ``` ```markdown ## Truth Source Hierarchy (P0-P3) | Level | Location | Purpose | Update Frequency | |-------|----------|---------|-----------------| | **P0 Single Source of Truth** | state.db (holdings + portfolios tables) | Positions, account data | Auto after each trade | | **P1 Structured Cache** | core/*.json | Identity, preferences, strategy, lessons | Manual + auto validation | | **P2 Session Logs** | sessions/*.md | History records, not used in decisions | Every session | | **P3 Learning Notes** | learnings/*.md | Lessons learned, for post-mortem | After the fact | **Core rule:** Real-time decisions only use P0 (API real positions + hardcoded rules). Historical memory only for post-mortem. ``` ### Technical Analysis The design persistently stores session logs, context snapshots, identity data, user profiles, preferences, holdings, portfolios, and account data in Markdown, JSON, and SQLite files. However, it does n ...[truncated 2148 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly directs automatic local persistence behaviors such as writing to session-state.json before replying, auto-triggering working-buffer.md writes, and auto-promoting memories, but it does not clearly warn users that their prompts, preferences, decisions, and other session-derived content may be stored and updated on disk automatically. This creates a real privacy and consent risk because users may disclose sensitive data without realizing it will be retained across sessions in multiple local files and databases.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.