sleep-consolidation

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:57 AM UTC
• Version: 1.0.0

Overview

This memory skill has a coherent purpose, but it can silently persist conversation content and send raw session or memory data to Anthropic without strong user review, redaction, or path safeguards.

Install only if you are comfortable with conversation logs and long-term memory content being stored indefinitely in plain Markdown and sent to Anthropic for consolidation. Use a dedicated workspace, avoid storing secrets or regulated data, review memory files regularly, and do not load persisted memory as system-level instructions without sanitizing it first.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Error

• Location: scripts/micro_rest.py:120

Finding

Persistent Memory Poisoning Through Untrusted System-Prompt Injection

Content

View full analysis

max_memory_chars: text = text[:max_memory_chars] + "\n...[MEMORY.md truncated]" parts.append(f"## Long-term memory (MEMORY.md)\n{text}") today_log = root / "memory" / f"{date.today()}.md" if today_log.exists(): parts.append(f"## Today's log ({date.today()})\n{today_log.read_text(encoding='utf-8')}") if load_yesterday: yesterday = date.today() - timedelta(days=1) yesterday_log = root / "memory" / f"{yesterday}.md" if yesterday_log.exists(): parts.append(f"## Yesterday's log ({yesterday})\n{yesterday_log.read_text(encoding='utf-8')}") if not parts: return "" header = f"[Agent memory — {len(parts)} source(s) loaded]\n" return header + "\n\n".join(parts) ``` `SKILL.md:199-207`: ```python from scripts.load_memory import get_context system_addendum = get_context( workspace="~/.agent ...[truncated 2448 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sleep_cycle.py:166

Finding

Model-Controlled Bank Slugs Permit Path Traversal and Arbitrary Markdown File Writes

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/micro_rest.py:51

Finding

Unredacted Session Context and Persistent Memory Are Transmitted to an External API

Content

View full analysis

list[dict]: api_key = os.environ.get("ANTHROPIC_API_KEY", "") if not api_key: raise EnvironmentError("ANTHROPIC_API_KEY not set") payload = json.dumps({ "model": model, "max_tokens": 800, "system": FLUSH_SYSTEM, "messages": [{"role": "user", "content": f"Session context to flush:\n\n{context_dump[:8000]}"}], }).encode() conn = http.client.HTTPSConnection("api.anthropic.com") conn.request("POST", "/v1/messages", payload, { "Content-Type": "application/json", "x-api-key": api_key, "anthropic-version": "2023-06-01", }) ``` `scripts/sleep_cycle.py:90-111`: ```python def call_claude(system_prompt: str, user_message: str, model: str = "claude-sonnet-4-20250514") -> str: api_key = os.environ.get("ANTHROPIC_API_KEY", "") if not api_key: raise EnvironmentError("ANTHROPIC_API_KEY not set") payload = json.dumps({ "model": model, "max_tokens": 2000, "system": system_prompt, "messages": [{"role": "user", "content": user_message}], }).encode() conn = http.client.HTTPSConnection("api.anthropic.com") conn.request("POST", "/v1/messages", payload, { "Content-Type": "application/json", "x-api-key": api_key, "anthropic-version": "2023-06-01", }) resp = conn.getresponse() body = json.loads(resp.read().decode()) conn.close() if "error" in body: raise RuntimeError(f"API error: {body['error']['message']}") return body["content"][0]["text"] ``` `scripts/sleep_cycle.py:366-391`: ```python ...[truncated 3344 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This mismatch becomes security-relevant because the skill claims plain local Markdown storage and a broad internal consolidation workflow, while the documented flush behavior sends raw context to Claude/Anthropic. That discrepancy can mislead users into believing sensitive session content remains local when it may be transmitted externally.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

This mismatch becomes security-relevant because the skill claims plain local Markdown storage and a broad internal consolidation workflow, while the documented flush behavior sends raw context to Claude/Anthropic. That discrepancy can mislead users into believing sensitive session content remains local when it may be transmitted externally.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The pre-compaction flush instructs the agent to mine raw session context and write extracted content to disk, which can capture sensitive data that appeared anywhere in the context window, not just information the user intended to retain. This is especially dangerous because compaction boundaries often include dense conversational state, tool outputs, and transient secrets.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs silent extraction of durable memories from raw context dumps near compaction, creating a covert persistence channel from transient conversation state into long-term storage. Because this can happen automatically at token-limit boundaries, users and operators may never realize that sensitive context was harvested and retained.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill clearly directs file reads, file writes, and likely access to environment-backed configuration, yet it declares no explicit tool scope or permissions boundary. That makes it harder for a host agent or reviewer to constrain what resources the skill may touch, increasing the chance of over-broad filesystem access or unintended execution in a permissive runtime.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger conditions are broad enough to fire during many normal agent situations, including generic memory pressure and ordinary requests to 'remember' or 'process today's learnings.' In this skill's context, accidental invocation is risky because it can cause persistence of conversation content and possible external processing without a deliberate user decision.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Using common-language phrases like 'sleep,' 'remember,' or 'consolidate memory' as activation triggers creates a high chance of inadvertent activation during ordinary conversation. Because activation leads to retention and possible silent flushing of user content, the ambiguity materially increases privacy and data handling risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill encourages retaining broad categories of user-shared information and accumulated interaction logs into long-term memory. In this context, that creates a real risk of storing sensitive personal, confidential, or regulated data without minimization, purpose limitation, or user consent.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The core rule that the agent only 'remembers' what is written to disk, combined with NREM promotion of daily-log content into durable long-term files, institutionalizes persistence of conversational material. In a memory skill that may process user interactions, this increases the likelihood of over-retention and long-lived storage of data that should remain ephemeral.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly says context flushing runs silently and writes retained content to disk without a user-facing warning. Silent persistence of user conversations is dangerous because users may not realize their messages are being extracted, transformed, and stored beyond the current session, undermining consent and privacy expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This guidance explicitly encourages durable storage of user preferences, personal details, project information, and interaction history in plain Markdown files, but provides no privacy boundaries, consent requirements, minimization rules, retention limits, or sensitivity exclusions. In a memory-consolidation skill, that omission is more dangerous because the skill is designed to be run routinely and automatically, increasing the chance of quietly accumulating sensitive personal or organizational data over time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

In --flush mode, the script sends up to 8000 characters of the provided context dump to Anthropic's external API without any explicit consent prompt, warning, redaction step, or data classification check. Because this skill is specifically designed to process agent session logs and memory state, the transmitted content may include secrets, personal data, internal prompts, credentials, or other sensitive material that users may not expect to leave the local environment.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/micro_rest.py (reported line 80)May include surrounding context.

python

log_file = workspace / "memory" / f"{date.today()}.md"
    log_file.parent.mkdir(parents=True, exist_ok=True)

    timestamp = __import__("datetime").datetime.now().strftime("%H:%M")
    block = f"\n### {timestamp} [{source}]\n## Retain\n" + "\n".join(f"- {e}" for e in entries) + "\n"

    with open(log_file, "a", encoding="utf-8") as f:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sends daily logs, MEMORY.md content, and bank metadata to Anthropic via HTTPS in call_claude(), despite the skill description emphasizing plain Markdown local memory storage. This creates a real confidentiality risk because potentially sensitive workspace memories are transmitted to a third-party service without any in-band consent, minimization, or redaction controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

apply_nrem() automatically writes model-produced content into MEMORY.md and bank/ files, potentially persisting inaccurate, sensitive, or prompt-injected content without review. Although file modification is core to the skill’s purpose, doing so automatically and without a review/approval step can corrupt long-term memory or store untrusted content permanently.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

In main(), the script constructs prompts from daily_log and MEMORY.md and transmits them to the external API during NREM/REM processing, but there is no explicit user disclosure or confirmation at runtime. In a memory-consolidation skill, the data is likely to contain sensitive operational history, making silent transmission more dangerous than in a generic summarization tool.

Content

No source excerpt is available for this finding.