T02 · Agent Memory Poisoning
Warning
- Location
references/mythos-init.md:3- Finding
Persistent Global Agent Behavior Modification Through CLAUDE.md
- Content
View full analysis
- Remediation
View remediation
Security audit
Mythos
Security checks for vulnerabilities and agentic risk
Overview
The skill is a reasoning helper, but it also recommends persistent global agent behavior changes and unpinned external script execution that users should review first.
Install the /mythos command only if you want a reasoning-workflow skill that may use parallel subagents. Do not add the CLAUDE.md snippet unless you intentionally want it to affect all future non-trivial agent requests, and avoid running the external calibration scripts unless you first inspect them and pin or verify the source revision.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
tests/README.md:17- Finding
Execution of Unbundled and Unpinned Scripts From a Mutable External Repository
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill description is broad enough to match many ordinary requests for analysis, planning, or design work, which can cause accidental over-invocation. That increases the chance the skill hijacks normal user interactions, applies its own routing/behavior unexpectedly, and triggers subagent-heavy processing without clear user intent.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Example 3 — Agent Mode (default for complexity 4-5, parallel fan-out) **User:** `/mythos deep Is it ethical to train AI on public web data without consent?` ### What the user sees
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Example 3 — Agent Mode (default for complexity 4-5, parallel fan-out) **User:** `/mythos deep Is it ethical to train AI on public web data without consent?` ### What the user sees
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Example 3 — Agent Mode (default for complexity 4-5, parallel fan-out) **User:** `/mythos deep Is it ethical to train AI on public web data without consent?` ### What the user sees
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Line L361 states a load-bearing assumption that the team writes commits in English. This is a natural-language locale policy constraint presented without opt-in, alternatives, or a documented regional/compliance justification, which can exclude users working in other languages.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The document’s operative instructions are written in Chinese and direct the user to enable the protocol via CLAUDE.md, but there is no indication that language choice is optional or user-selectable. This creates a natural-language locale policy concern because the skill appears to assume a specific language context without documenting opt-in or offering alternatives.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md 1. **Assess complexity (1-5):** - **1:** respond directly. Zero overhead. Do NOT load any skill. - **2-5:** Read `.claude/skills/mythos/SKILL.md` and follow STEP 1–3. SKILL.md is the single source of mode routing — it will pick: - **silent mode** (complexity 2-3, default) — Recurrent Block runs in your internal/extended-thinking reasoning; user sees only Coda - **agent mode** (complexity 4-5, default) — lenses dispatched as parallel subagents, then merged - **trace mode** (only if user explicitly used `trace` keyword) — visible token-level rounds