T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:72- Finding
Untrusted Learning Content Can Be Promoted into Persistent Agent Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Keep Learning Agent
Security checks for vulnerabilities and agentic risk
Overview
This skill is a learning and memory framework, but it asks agents to run unreviewed local PowerShell scripts and can promote conversation-derived notes into persistent agent instructions.
Review this skill before installing. It may be acceptable in a controlled personal setup, but only enable the PowerShell startup scripts after auditing them, locking down their file permissions, and requiring explicit approval before any learning record is promoted into AGENTS.md or other persistent agent instruction files.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:186- Finding
Automatic Startup Execution Relies on Unbundled and Unverified External PowerShell Scripts
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The primary descriptive text for the skill is presented in Chinese, and the document does not indicate that other languages are supported or that Chinese is optional. This can violate a language/locale policy when users are not given a choice of language or informed that the skill is region- or language-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file's descriptive and operational content is predominantly written in Chinese, with no indication that users may choose another language. Under the language/locale policy, forcing a specific language without explicit opt-in or documented justification is a natural-language policy concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly documents automatic execution of local PowerShell scripts during session startup, including a self-repair script and autoloaded configuration. Even though this file is markdown, embedding startup automation that runs local scripts without consent, validation, or safety constraints can normalize unsafe behavior and lead an agent or operator to execute system-impacting code implicitly. The context makes this more dangerous because the automation is framed as a default workflow for every session, increasing frequency and blast radius if the referenced scripts are modified or malicious.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The natural-language description is presented only in Chinese and does not offer any user language choice or explain a region-specific requirement. That can indicate a language or locale policy issue when the skill appears to impose a specific language without user opt-in.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This manifest describes the skill in broad terms as a continuous-learning and self-improvement framework, but it does not indicate when the skill should activate, what phrases invoke it, or any exclusions. In a manifest file, that lack of trigger specificity can lead to overly broad matching or unintended invocation.
- Content