T02 · Agent Memory Poisoning
Error
- Location
scripts/scan_repos.py:14- Finding
Untrusted README Content Is Persisted in Agent-Readable Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
GitHub Helper
Security checks for vulnerabilities and agentic risk
Overview
This GitHub helper is purpose-related, but it needs Review because it persists untrusted repository text into an agent-readable file and asks the agent to modify the skill file for path changes.
Review before installing. Use it only on repository directories you trust, confirm before cloning or updating the knowledge base, avoid letting it edit SKILL.md for configuration, and inspect generated CLAUDE.md content because repository README text may be carried into future agent context.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/update_kb.py:10- Finding
Knowledge-Base Update Follows Symbolic Links and Unconditionally Truncates the Target
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 97% confidence
- Finding
The instruction to 'Update this SKILL.md path if needed' is a self-modification capability, which is dangerous because it allows runtime alteration of the skill's own trusted instructions and configuration. If influenced by a user-supplied path or adversarial context, this can permanently change future behavior, expand accessible locations, or weaken security constraints.
- Content
md If `/Users/liuchen/Documents/github` does not exist: 1. Ask user for the correct repository root path. 2. Update this SKILL.md path if needed. 3. Initialize knowledge base at the new location. ## Scripts
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill instructs reading and updating local files, including
CLAUDE.md, but does not declare any explicit tool scope or permission boundary. In practice this can lead to overbroad file access and writes beyond the intended repository helper workflow, especially because the skill operates on user-provided paths and maintenance scripts.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The activation text is broad enough to trigger on many ordinary mentions of GitHub, repos, or repositories, which can invoke file and repository-management behaviors unexpectedly. Because the skill can inspect local paths and propose clone/sync operations, unintended activation increases the chance of unnecessary data access or risky actions in the wrong context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The overview is written in Chinese while the rest of the skill is in English, implying a language constraint without any user opt-in or documented locale justification. This can violate language-choice policy because the skill does not state that responses should match user preference or offer alternatives.
- Content
Static analysis
No suspicious patterns detected.