Shared Memory

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:22 AM UTC
• Version: 1.1.2

Overview

This shared-memory skill is coherent, but it creates persistent cross-agent memory with weak isolation and trust-boundary guidance.

Install only if you intentionally want agents to share memory across sessions, repositories, and worktrees. Review memory files before agents load them, avoid storing secrets, and be especially careful with similarly named repositories because private local memory may collide.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:20

Finding

Persistent cross-session context poisoning through automatically loaded shared memory

Content

View full analysis

/dev/null || pwd)" SLUG="$(basename "$REPO_ROOT" | tr '[:upper:]' '[:lower:]')" # Durable layers K0="$HOME/.shared-memory/global" K1="$REPO_ROOT/.agents/memory" K2="$HOME/.shared-memory/$SLUG" [ -f "$K0/MEMORY.md" ] && cat "$K0/MEMORY.md" [ -f "$K1/MEMORY.md" ] && cat "$K1/MEMORY.md" [ -f "$K2/MEMORY.md" ] && cat "$K2/MEMORY.md" ``` ```markdown Install the Skill Genie session-start rules so every new agent session runs the idempotent linker before it reads handoffs. Merely installing this skill does not make a client invoke it automatically. ``` ### Technical Analysis The Skill defines persistent memory layers that can be written by repository contributors, local users, or other agents. It then directs every agent session to read the corresponding indexes and runtime handoffs without defining a trust boundary, integrity check, provenance validation, or rule requiring the loaded text to be treated strictly as untrusted data. The K1 memory layer is Git-tracked and can therefore be modified through commits, branches, pull requests, or a compromised repository. Runtime handoff files are intentionally shared between worktrees and agents. If these files contain instruction-like content, an agent may interpret it as authoritative operational context rather than passive reference data. The behavior does not itself grant operating-system privileges or execute code directly. However, poisoned m ...[truncated 1597 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:34

Finding

Repository basename collision exposes project-private memory across unrelated repositories

Content

View full analysis

/` - Purpose: personal notes or sensitive details not suitable for git - Format: same structure as K1 ``` ```bash REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null || pwd)" SLUG="$(basename "$REPO_ROOT" | tr '[:upper:]' '[:lower:]')" # Durable layers K0="$HOME/.shared-memory/global" K1="$REPO_ROOT/.agents/memory" K2="$HOME/.shared-memory/$SLUG" [ -f "$K0/MEMORY.md" ] && cat "$K0/MEMORY.md" [ -f "$K1/MEMORY.md" ] && cat "$K1/MEMORY.md" [ -f "$K2/MEMORY.md" ] && cat "$K2/MEMORY.md" ``` ### Technical Analysis The private K2 storage namespace is derived only from the lowercased basename of the repository root. Repository basenames are neither unique nor stable security identifiers. Two unrelated repositories located at paths such as `/home/user/client-a/service` and `/tmp/untrusted/service` both resolve to: ```text ~/.shared-memory/service/ ``` Case normalization introduces additional collisions, such as `Project` and `project`. Because K2 is explicitly intended to hold personal notes or sensitive project details, namespace collisions violate isolation between unrelated repositories. Any session operating in a colliding repository can read the same `MEMORY.md` file. If the Skill's write operations are used, that session may also update or overwrite the shared private-memory index and associated entries. No repository identity metadata is checked before access. ### Attack Path 1. A trusted repository named `service` uses K2 storage at `~/.shared-memory/service/`. 2. Private notes or sensitive project context are written to that location. 3. A user clones or opens a different, potentially attacker-controlled repository whose root directory is also named ...[truncated 991 chars]

Remediation

View remediation

/dev/null || true)" identity="${remote_url}|${REPO_ROOT}" project_id="$(printf '%s' "${identity}" | sha256sum | cut -d' ' -f1)" K2="$HOME/.shared-memory/projects/${project_id}" ``` 4. Store metadata containing the expected repository root and normalized remote URL inside each K2 directory. 5. Verify the stored identity before every read or write and fail closed when it does not match. 6. Set restrictive permissions on private storage, such as mode `0700` for directories and `0600` for files. 7. Provide a migration procedure for existing basename-based directories, including collision detection and explicit user confirmation. 8. Avoid automatically loading K2 data when repository identity is absent, ambiguous, or changed. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

The skill is explicitly designed to persist and share state for any AI agent across sessions, repositories, and worktrees, including machine-wide and git-tracked locations. This creates a real session-persistence risk: data can outlive the originating session, propagate to other agents, and be committed to source control, increasing the chance of sensitive data leakage, prompt/data poisoning, or unsafe trust transfer between agents.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: "shared-memory"
description: "Read and write shared state for ANY AI agent with a dual-layer model: durable cross-agent knowledge (`.agents/memory` + optional private local layer) and real-time cross-worktree runtime memory (`.trellis/shared` symlinked to `<git-common-dir>/trellis-shared`). Use for project memory, handoffs, and multi-worktree coordination."
license: "MIT"
allowed-tools: "Bash, Read, Write, Edit, Glob, Grep"
metadata: {"version":"1.1.2","category":"cross-agent-coordination","triggers":["save to shared memory","remember this for all agents","shared memory","global memory","cross-agent memory","worktree shared memory","cross-worktree handoff","agent shared state"],"license":"MIT","tags":["shared-memory","cross-agent-coordination","project-memory","worktree","handoff"],"hermes":{"tags":["shared-memory","cross-agent-coordination","project-memory","worktree","handoff"]}}

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list is broad and includes generic phrases like "shared memory," "global memory," and "remember this for all agents," which can cause the skill to activate in contexts the user did not explicitly intend. Because this skill writes persistent cross-agent state, accidental invocation can lead to unreviewed persistence of sensitive or misleading information across sessions and worktrees.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The durable memory write operation formalizes persistence into both machine-local and git-tracked stores without requiring robust safeguards beyond a brief checklist. In practice, this can enable accidental retention of sensitive information, cross-session contamination of future agent behavior, and repository-level propagation of untrusted or harmful content.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md

Read indexes first, then load specific files on demand.

## Operation 2 — Write durable memory (K1/K2)

Classify each write as:
- `global` -> K0 (`~/.shared-memory/global`) for machine-wide private lessons

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/worktree-shared-framework.md (reported line 22)May include surrounding context.

└── events/

text

## Data ownership and write model

- `agents/<agent>.jsonl`: append-only; only that agent writes.
- `events/YYYY/MM/DD.jsonl`: append-only event stream.

Static analysis

No suspicious patterns detected.