T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:105- Finding
Unvalidated Task Content Can Poison Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
Task Experience Logger
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent task-logging aid, but it directs persistent memory updates and storage of full diagnostic details without clear consent or redaction controls.
Review before installing. Use this only if you want persistent task records, and avoid saving raw logs, screenshots, credentials, tokens, customer data, or private operational details. Prefer requiring explicit approval and sanitized summaries before anything is written to MEMORY.md.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:30- Finding
Complete Error Logs May Be Persisted Without Secret or Personal-Data Redaction
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill description is broadly scoped to 'any task' involving recording experience, summarization, or knowledge-base building, which can cause the skill to trigger for many ordinary user requests outside a narrowly defined context. Over-broad activation increases the chance that sensitive task content is captured and persisted when the user did not explicitly ask for logging or memory storage.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The metadata states that the skill supports automatic saving to long-term memory, but it does not warn the user that information may persist beyond the current session. This creates a privacy and consent risk because users may provide error logs, internal notes, or sensitive operational details without realizing they will be retained.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill encourages persistent recording of detailed task artifacts, including error logs, timestamps, problem details, and tool validation data, and then promotes transferring key information into long-term memory without minimization or sensitivity filtering. In practice this can capture credentials, tokens, internal paths, customer data, incident details, or other secrets, making the skill materially more dangerous because its core purpose is broad collection and retention of operational data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instructions direct the agent to update MEMORY.md after task completion but omit any requirement to inform the user that data will be retained across sessions. Because the recorded categories include problems, solutions, logs, and tool details, this can persist sensitive operational information without user awareness or approval.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The natural-language instructions and description are presented in Chinese, which effectively imposes a language choice on users if no alternative is offered. The file does not indicate that the skill is intentionally region-specific or provide an opt-in or multilingual option.
- Content