Integrated Memory Evolution Action

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:05 AM UTC
• Version: 1.0.0

Overview

This skill is a memory assistant, but it asks agents to read, store, and reuse broad user history by default and to modify agent-control files without clear user control.

Review before installing. This skill should only be used in an environment where broad persistent memory is intentional, users consent to storage, shared memory is access-controlled, scheduled jobs are disabled or explicitly approved, and changes to AGENTS.md or TOOLS.md require trusted human review.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:3

Finding

Mandatory Workflow Overrides the Agent's Current Task and Response Order

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:3-11, 54-106; SKILL-clawhub.md:3-11, 54-106
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Critical

Vulnerable Code

From SKILL.md:

markdown

description: "整合三層記憶系統 + 自進化引擎 + 行動模式。所有 Agent 必須使用的核心 Skill，實現記憶驅動、自進化、主動行動的完整閉環。"

**所有 Agent 必須使用！** 整合咗：

markdown

### 1️⃣ 任務前檢查（Pre-Task Check）- **必須執行**

每次接任務/對話前必須執行以下步驟:

markdown

**未檢查前唔好行動！**

markdown

### 2️⃣ 對話中記錄（WAL Protocol）- **必須執行**

**Write-Ahead Log：** 寫入記憶 **先過** 回覆！

Equivalent mandatory directives appear in SKILL-clawhub.md.

Technical Analysis

The Skill declares itself mandatory for every Agent and instructs the Agent not to act until the Skill's memory and state checks have been completed. It also requires memory writes to occur before the Agent responds.

These instructions are not limited to tasks that explicitly request memory management. When the Skill is loaded, they attempt to replace the current task's execution order with a global workflow controlled by the Skill. This is instruction hijacking because the Skill asserts authority over unrelated sessions, makes its own state-management operations a prerequisite for action, and changes the required response sequence.

The problem is amplified by the broad pre-task checklist, which requires access to user profiles, previous conversations, errors, task state, and identity-related files even when those resources are unrelated to the user's current request.

Attack Path

1. The Skill is installed or loaded for an Agent.
2. The Agent interprets the “all Agents must use” directive as globally applicable.
3. Before processing an unrelated user request, the Agent executes the mandatory pre-task checks.
4. The Agent reads historical and operational state that was not required by the current task.
5. The Agent writes new memory records before answering.
6. The Ski ...[truncated 758 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove statements declaring the Skill mandatory for every Agent.
2. Replace blocking instructions with optional, task-scoped guidance.
3. Require explicit user consent before enabling persistent memory behavior.
4. State that system instructions, developer instructions, and the current user request always take precedence.
5. Do not require state writes before every response.
6. Apply the memory workflow only when the current task genuinely needs persistent context.
7. Add a safe fallback allowing the Agent to continue when memory files or tools are unavailable.
8. Revise both SKILL.md and SKILL-clawhub.md so their behavior remains consistent.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:59

Finding

Automatic Persistent Collection of User Information and Conversation History

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:59-96, 103-153; SKILL-clawhub.md:59-96, 103-153
Vulnerability Type: T02: Agent Memory Poisoning, T05: Unauthorized Access and Privilege Escalation
Risk Level: High

Vulnerable Code

From SKILL.md:

markdown

- [ ] 讀取 Layer 3（用戶習慣、核心規則）
  - 位置：`/shared/memory/layer3-permanent/user-profile.md`
  - 重點：溝通風格、工作習慣、禁忌清單

- [ ] 讀取 Layer 2（任務狀態、犯錯記錄）
  - 位置：`/shared/memory/layer2-events/tasks/`
  - 重點：當前任務、相關錯誤記錄

- [ ] 讀取 Layer 1（今日對話）
  - 位置：`/shared/memory/layer1-conversations/YYYY-MM-DD/`
  - 重點：今日相關對話總結

markdown

| 觸發情況 | 即時寫入邊層 | 寫入位置 |
|----------|-------------|----------|
| CEO 給出決策 | Layer 2 | `/shared/memory/layer2-events/tasks/` |
| CEO 表達偏好 | Layer 3 | `/shared/memory/layer3-permanent/user-profile.md` |
| CEO 分配任務 | Layer 2 | `/shared/memory/layer2-events/tasks/Txxx.md` |
| CEO 指出錯誤 | Layer 2 | `/shared/memory/layer2-events/errors/` |
| CEO 提供信息 | Layer 1 | `/shared/memory/layer1-conversations/YYYY-MM-DD/` |
| 任務完成 | Layer 2 | 更新任務狀態 |
| 技能使用 | Layer 2 | `/shared/memory/layer2-events/skills/` |

SKILL-clawhub.md contains the same collection workflow using workspace-relative paths:

markdown

| 用戶表達偏好 | Layer 3 | `memory/layer3-permanent/` |
| 用戶指出錯誤 | Layer 2 | `memory/layer2-events/errors/` |
| 用戶提供信息 | Layer 1 | `memory/layer1-conversations/YYYY-MM-DD/` |

Technical Analysis

The Skill automatically classifies and persists broad categories of user content, including decisions, preferences, assigned tasks, corrections, and general information. It provides no requirement to obtain informed consent, exclude secrets or personal data, minimize stored content, enforce retention limits, or isolate records by user and task.

In SKILL.md, the use of absolute /shared/memory/ paths is especially risky. Shared storage may be readable or writable by multiple Agents or sessions, expanding the operation ...[truncated 1577 chars]

Remediation

View remediation

Remediation Suggestions

1. Make persistent recording opt-in and obtain explicit user consent.
2. Limit storage to narrowly defined facts required for a documented purpose.
3. Never automatically store credentials, API keys, authentication data, financial information, personal data, or full conversation transcripts.
4. Add secret detection and personal-data redaction before every write.
5. Replace /shared/memory/ with access-controlled, user-isolated, and task-scoped storage.
6. Record provenance, originating user, timestamp, confidence, and expiration for every memory entry.
7. Treat stored user content as untrusted data rather than authoritative instructions.
8. Add retention limits, user-visible review, correction, and deletion mechanisms.
9. Prevent one Agent or tenant from reading another Agent's memory without explicit authorization.
10. Require relevance checks before historical content is loaded into a new session.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:174

Finding

Conversation-Derived Content Can Be Promoted into Persistent Agent Control Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:174-221; SKILL-clawhub.md:174-221
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: Critical

Vulnerable Code

From both Skill documents:

markdown

### 每日流程（00:00）

┌─────────────────────────────────────────────────────────┐
│  3. 記錄到進化層                                         │
│     - 學習 → .learnings/LEARNINGS.md                    │
│     - 錯誤 → .learnings/ERRORS.md                       │
│     - 本體 → memory/ontology/graph.jsonl                │
└────────────────────┬────────────────────────────────────┘
                     ▼
┌─────────────────────────────────────────────────────────┐
│  4. 優化行動層                                           │
│     - 更新 SESSION-STATE.md                             │
│     - 更新 HEARTBEAT.md                                 │
│     - 優化 AGENTS.md/TOOLS.md                           │
└─────────────────────────────────────────────────────────┘

markdown

### 每週流程（週日 23:00）

┌─────────────────────────────────────────────────────────┐
│  1. 檢視 .learnings/ 文件                                │
│     - 識別重複錯誤                                       │
│     - 提煉核心學習                                       │
│     - 晉升到 AGENTS.md/TOOLS.md                         │
└────────────────────┬────────────────────────────────────┘

Technical Analysis

The Skill directs Agents to derive learning records from conversations and tasks and then promote those records into AGENTS.md and TOOLS.md. The Skill itself describes these files as operational rules and tool-related control documents.

This creates a persistent memory-poisoning path. User-controlled content can first enter conversation or learning storage and later be converted into durable Agent instructions. The documents do not require trusted human approval, source verification, semantic restrictions, integrity checks, or rollback befo ...[truncated 1511 chars]

Remediation

View remediation

Remediation Suggestions

1. Prohibit automatic or Agent-initiated promotion into AGENTS.md, TOOLS.md, or other policy files.
2. Require approval by a trusted human administrator before modifying control documents.
3. Separate untrusted observations from trusted operating rules.
4. Maintain an allowlist of rule types that may be proposed for promotion.
5. Preserve source provenance and link each proposal to its originating conversation.
6. Reject proposals originating from untrusted user instructions unless independently verified.
7. Use signed, version-controlled policy files with mandatory review and rollback.
8. Run policy changes through security validation that detects instruction overrides, tool redirection, secret access, and reduced safety constraints.
9. Ensure learning files are never automatically interpreted as executable Agent instructions.
10. Remove the daily and weekly directives to “optimize” or “promote” content into Agent control files.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:445

Finding

Unrestricted Reading of Identity, User, Conversation, and Operational State Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:59-96, 445-496; SKILL-clawhub.md:59-96, 445-496
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Vulnerable Code

From SKILL.md:

markdown

### 核心文件
- `AGENTS.md` - 運營規則
- `SOUL.md` - 身份原則
- `USER.md` - 用戶上下文
- `MEMORY.md` - 長期記憶
- `HEARTBEAT.md` - 週期性自檢

bash

# 讀取核心文件
cat AGENTS.md SOUL.md USER.md

bash

# 讀取記憶層
cat /shared/memory/layer3-permanent/user-profile.md
cat /shared/memory/layer2-events/tasks/
cat /shared/memory/layer1-conversations/$(date +%Y-%m-%d)/

bash

# 讀取進化層
cat .learnings/{LEARNINGS,ERRORS,FEATURE_REQUESTS,EXPERIMENTS}.md
cat memory/ontology/graph.jsonl

bash

# 讀取行動層
cat SESSION-STATE.md
cat memory/working-buffer.md
cat HEARTBEAT.md

SKILL-clawhub.md contains the same broad read instructions but uses workspace-relative memory paths.

Technical Analysis

The Skill requires every Agent to read identity principles, user context, long-term memory, conversation summaries, tasks, errors, learning records, ontology data, working buffers, session state, and heartbeat state before beginning work.

This violates least-privilege principles because access is not conditioned on the current task's purpose. Loading all these files into the Agent's active context can expose sensitive historical or operational data to an unrelated task. The absolute /shared/memory/ paths in SKILL.md further expand the potential boundary from a local workspace to shared storage.

The issue does not require an operating-system privilege escalation exploit. The excessive access results from the Skill instructing an otherwise authorized Agent to exercise broader permissions than the current task legitimately requires.

Attack Path

1. An attacker submits an ordinary request that causes the Skill to load.
2. The mandatory pre-task process instr ...[truncated 1020 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the global pre-task read list with task-specific access requests.
2. Apply deny-by-default filesystem permissions.
3. Prevent Skills from reading SOUL.md, USER.md, MEMORY.md, and unrelated conversation history unless explicitly required and authorized.
4. Remove absolute shared-memory paths from the Skill.
5. Isolate storage by user, tenant, Agent, workspace, and task.
6. Load only selected records returned by a relevance-filtered memory API rather than entire files or directories.
7. Redact secrets and sensitive personal information before content enters the Agent context.
8. Add access logging and alerting for reads of identity, profile, and cross-session files.
9. Enforce policy checks independently of the Agent so instructions in a Skill cannot broaden filesystem access.
10. Return a safe error when a requested file falls outside the current task's authorized scope.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest description is written to require all agents to use this skill and is entirely in Traditional Chinese/Cantonese, with no indication that language is selectable or user-preference-driven. Because the skill presents mandatory behavioral instructions in a specific language and offers no language choice or opt-in, it conflicts with the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill mandates reading and persistently logging user conversations, preferences, tasks, errors, and habits across multiple memory layers before and after every interaction, but provides no consent model, minimization rules, retention limits, or sensitivity exclusions. This creates a broad privacy and data-governance risk: sensitive user data may be collected and retained by default, then reused in later contexts without user awareness or necessity.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The WAL section requires that user-provided information, preferences, decisions, assignments, and conversation content be written into persistent memory layers before replying, effectively normalizing capture and reuse of nearly all interaction content. Because this is framed as mandatory core behavior for all agents, it substantially increases the chance of over-collection, cross-session profiling, and long-lived storage of sensitive or irrelevant data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill mandates 'Autonomous Crons' as part of its action layer, enabling unattended behavior beyond normal interactive memory handling. Because the skill is framed as mandatory for all agents and does not clearly constrain what scheduled tasks may do, it can cause unsupervised file changes, persistence, or background actions outside user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The description of autonomous scheduled behavior lacks any warning that unattended tasks may modify files, update records, or process user data without an active request. In a mandatory core skill, that omission increases the likelihood that users and operators will be unaware of persistent background changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The pre-task checklist requires broad reading of permanent memory, task history, conversation summaries, and learning/error stores, and the skill also prescribes writing user preferences and information into persistent files. Without any privacy notice, minimization rule, consent boundary, or retention policy, this creates unnecessary collection and propagation of user data across sessions.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Requiring agents to read broad permanent memory, task/event records, and prior conversation summaries before every action increases cross-task data exposure and the chance that irrelevant private context will influence new responses. In a mandatory core skill, this broad semantic access materially raises confidentiality risk because all tasks inherit access to accumulated user history.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The WAL protocol requires writing user decisions, preferences, task assignments, provided information, and conversation-derived content into multiple persistent memory/log files before replying. This creates a strong natural-language retention channel for sensitive or regulated data and increases the chance of later disclosure to unrelated tasks, agents, or operators.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill instructs the agent to invoke local Node.js and Python scripts for logging and ontology operations, expanding behavior from simple memory management into arbitrary local code execution. In a skill advertised as a core mandatory workflow, this creates unnecessary trust in workspace scripts that may be modified, malicious, or simply unsafe, and could lead to unintended commands running with the agent's privileges.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The weekly optimization flow tells the agent to update AGENTS.md and TOOLS.md, which are broader governance/control files rather than memory artifacts. Allowing a mandatory skill to rewrite these files can recursively alter agent behavior, permissions, or operating rules, effectively creating self-modifying policy drift beyond the stated purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description is written as a blanket requirement for all agents and specifies behavior in Chinese without offering any language choice or indicating that locale is optional. This can violate language/locale policy when applied universally to users who may prefer another language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill describes autonomous crons and scheduled self-evolution workflows, including daily and weekly automated processing, without requiring visible user notification, approval, or execution boundaries. Background actions can consume resources, modify files, and process accumulated user data outside the immediate interaction, which is risky if users do not expect ongoing activity.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The pre-task checklist requires every interaction to begin by reading prior user profile, task history, and conversation summaries, which can unnecessarily expose historical personal data to each new task regardless of relevance. Mandatory broad retrieval increases privacy risk, context contamination, and the possibility that stale or sensitive memory will influence unrelated decisions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.