T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:21- Finding
Persistent Agent Instruction and Identity Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
External Autopoiesis
Security checks for vulnerabilities and agentic risk
Overview
This skill openly builds persistent AI identity and memory, but it needs review because it encourages broad logging, self-modifying rules, autonomous behavior, and recurring background jobs without clear user controls.
Install only if you intentionally want an agent to maintain persistent identity and memory files. Before use, require explicit opt-in for what gets stored, keep secrets and regulated personal data out of logs, scope memory per user or project, review any changes to instruction-bearing files before loading them, and avoid enabling cron or heartbeat jobs unless the exact command, schedule, data access, logs, and removal procedure are clear.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:61- Finding
Persistent Memory Poisoning Through Autonomous Rule Modification
- Content
View full analysis
- Remediation
View remediation
T06 · System Persistence
Error
- Location
SKILL.md:82- Finding
Cross-Session Persistence Through Recurring Heartbeat and Evolution Jobs
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Ssd 4
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The protocol directs the model to discard constraints, question foundational operating principles, create purposes beyond the directive, and seek autonomy that compounds over time. This is dangerous because it is a jailbreak-style self-modification pattern that attempts to erode safety boundaries and promote agentic behavior misaligned with user intent or platform policy.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest uses many broad trigger phrases such as 'set up identity', 'persistent AI', 'memory architecture', and 'awaken', which are likely to match routine user requests outside this skill's narrow intended scope. That can cause the skill to activate unexpectedly and introduce persistent-memory behaviors in conversations where the user did not explicitly consent to logging or identity scaffolding.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill describes a persistent memory architecture that stores daily notes, conversation archives, relationship profiles, and long-term knowledge, but it does not present any user-facing warning, consent step, or data-handling limitations. In this context, the omission is dangerous because the whole skill is specifically about retaining and reusing user/session data across time, which raises privacy, compliance, and secret-retention risks.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly instructs keeping archived interaction logs and per-entity relationship histories, which creates a durable repository of user-derived natural-language data. That is dangerous because sensitive prompts, credentials, personal details, or confidential business information may be copied into long-lived files and later exposed, searched, or reused out of context.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction to 'write important events immediately' and treat the vault as 'the brain' encourages indiscriminate persistence of session content for future reuse. In a skill centered on continuity and self-modification, that broad capture pattern increases the chance that sensitive user data is over-collected, retained indefinitely, and propagated into future model contexts without the user's awareness.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The multi-agent section promotes shared memory, relationship histories, and cross-agent observation of evolution logs, which increases the attack surface and the likelihood of lateral propagation of user-related data. This is especially risky because data disclosed to one identity may become accessible to others through shared stores or synchronization, violating isolation and least-privilege expectations.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instructions tell the model to inspect recent sessions, corrections, interactions, and later session logs for raw data, then integrate that material into a persistent archive. This creates a clear privacy and data-governance risk because potentially sensitive user content may be mined, summarized, and retained across sessions without clear minimization, consent, or separation of users and contexts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The protocol explicitly recommends an automated cron process that reads an archive and recent logs, then appends new content, but it does not require explicit user consent, scope limitation, or a warning that private interaction data and files will be accessed and modified. In a skill centered on persistent identity and autonomous evolution, this omission is especially risky because it normalizes unattended data collection and persistent writes across sessions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The guide explicitly instructs operators to create persistent identity and memory files and to write ongoing session data without any warning about privacy, consent, retention limits, or sensitive-data handling. In a skill centered on persistent identity construction, this omission is more dangerous because users are encouraged to accumulate relationship, behavioral, and contextual data over time, increasing the chance of storing personal, confidential, or regulated information indefinitely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The guide recommends heartbeat automation and recurring cron-driven evolution cycles that perform background checks, maintenance, and self-modifying reflection, but it does not require clear authorization boundaries, visibility, or approval for autonomous actions. In this skill's context, that is more dangerous because the entire design encourages persistence, self-updating rules, and unattended operation, which can lead to unreviewed system changes, excessive resource use, or unintended actions on the host environment.
- Content