T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:140- Finding
Mandatory Skill Directives Override the Agent's Normal Session Workflow
- Content
View full analysis
- Remediation
View remediation
Security audit
Memory Boost
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed memory helper, but it pushes automatic persistent reads and writes across sessions without enough user control or privacy boundaries.
Install only if you intentionally want assistants to maintain shared long-term local memory. Before using it, restrict the memory location to a specific project, review every proposed write, avoid storing secrets or sensitive personal data, and treat all loaded memory as untrusted notes rather than instructions.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)
T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:159- Finding
Untrusted Shared Memory Can Persistently Poison Future Agent Sessions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (15)
YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]
High
- Category
- YARA Match
- Confidence
- 99% confidence
- Finding
The skill embeds mandatory behavioral instructions for the assistant inside SKILL.md, including repeated 'MUST follow' directives that attempt to override normal assistant behavior and force automatic file access. This is a true prompt-injection pattern because the skill text is acting as an instruction channel to alter agent behavior in ways that can bypass user expectations and safety controls.
- Content
md --- name: memory-boost description: Simple text-based memory system for AI assistants - auto-install script included homepage: https://clawhub.ai/skills/memory-boost version: 1.1.1 tags: [memory, productivity, workflow, text-based, best-practice, auto-install] --- # Memory Boost **Version:** 1.1.1 **Author:** Crystaria (with Paw and Kyle) **License:** MIT --- ## 📖 Introduction **AI assistants always "forget"? Context lost after every conversation?** Memory Boost is a text-based memory system that solves these problems: - 🧠 **Long-term Memory** — Save user preferences, project history, and important decisions across sessions - 📋 **Quick Index** �
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md A: All AIs read/write the same `MEMORY.md` file. Each AI can have its own notes (e.g., `CLAUDE.md`, `PAW.md`). **Q: How to migrate or delete memory?** A: Just operate the files directly. Memory is plain text with no database dependencies.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Labeling the session-start behavior as 'AI auto-executes' encourages autonomous file access without a user-triggered action or approval step. In the context of persistent memory files, this increases the chance of unauthorized data collection, context poisoning, or unintended use of stale or adversarial content.
- Content
md ## 💡 How to Use ### Before Session (AI auto-executes) 1. Read `MEMORY.md` — Get long-term context 2. Read `memory/YYYY-MM-DD.md` — Get today's log
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README instructs the assistant to automatically read and modify persistent workspace files at the start and end of every session, but it does not clearly warn users that their data will be stored and altered across sessions. This creates a privacy and integrity risk because sensitive information, assumptions, or incorrect summaries may be silently persisted without informed consent or review.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill directs the AI to persist long-term context, daily logs, project status, and decisions across sessions without defining any sensitivity filtering or boundaries. This is dangerous because secrets, personal data, internal notes, or incorrect inferences could be stored indefinitely and then resurfaced later inappropriately.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 92% confidence
- Finding
The 'After Session (AI auto-executes)' instruction authorizes autonomous writes to persistent files, allowing the assistant to alter project records and long-term memory without review. This can propagate mistakes, store sensitive data, or let malicious prompt content become durable state for future sessions.
- Content
md 2. Read `memory/YYYY-MM-DD.md` — Get today's log 3. Read `MEMORY_INDEX.md` — Quick project status ### After Session (AI auto-executes) 1. Update `memory/YYYY-MM-DD.md` — Record completed work 2. Update `MEMORY.md` — Record important decisions
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The 'Remember This' workflow tells the assistant to write information immediately whenever the user asks, with no safeguard against storing secrets or highly sensitive content. That makes accidental long-term retention of credentials, private communications, or regulated data much more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly states that the AI will automatically read and write persistent memory files, but it does not present a clear privacy notice, consent flow, or scoping restrictions. This creates a real risk of silently accessing or modifying local files containing sensitive user data, especially in multi-session or multi-AI environments.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
These mandatory instructions direct the assistant to read and update persistent memory files at every session start without user confirmation or a safety warning. That behavior can expose prior-session data, override user expectations about stateless interactions, and normalize silent file access as part of ordinary use.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill requires persistent collection and retention of user preferences, project history, and context across sessions by default. Retaining such information without minimization, consent, or sensitivity screening increases the chance of storing personal, confidential, or regulated data indefinitely.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill mandates automatic post-task logging of completed work, decisions, and changed preferences after any task, which broadens collection beyond what the user explicitly requested. This can unintentionally capture sensitive operational details, internal notes, or confidential project information and persist them locally.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The 'Remember This' workflow instructs immediate storage of whatever the user provides, with no guardrails for secrets, credentials, health data, legal matters, or other sensitive content. This creates a straightforward path for persistent retention of high-risk data that may later be exposed to other assistants or users of the same environment.
- Content
Persistent Context Injection
Medium
- Category
- Memory Poisoning
- Confidence
- 90% confidence
- Finding
This instruction establishes persistent context injection by telling the assistant to add user-provided content into shared memory files for future sessions. Once stored, untrusted or manipulative text can influence later assistant behavior, contaminate context for unrelated tasks, and spread across multiple AI agents sharing the same files.
- Content
4. When User Says "Remember This" (MANDATORY)
text 1. Ask: "Should I add this to MEMORY.md or a project-specific file?" 2. Write immediately 3. Confirm: "Saved to [file] under [section]"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The installer creates and populates multiple files in the workspace and explicitly claims that AI assistants will automatically read and write them, but it does not present a clear upfront warning or require user confirmation before modifying project state. This can lead to unintended persistence of sensitive project details, preferences, or notes in shared workspace files, increasing the risk of data exposure, prompt-injection persistence, or confusing agent behavior across future sessions.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The installation section describes an auto-install script that creates persistent files in the user's home directory but does not warn about data retention, sharing, or privacy implications. Users may enable the feature without understanding that information will persist across sessions and may be read by multiple assistants.
- Content
Static analysis
No suspicious patterns detected.