Task Experience Logger

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:13 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent task-logging aid, but it directs persistent memory updates and storage of full diagnostic details without clear consent or redaction controls.

Review before installing. Use this only if you want persistent task records, and avoid saving raw logs, screenshots, credentials, tokens, customer data, or private operational details. Prefer requiring explicit approval and sanitized summaries before anything is written to MEMORY.md.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:105
• Finding: Unvalidated Task Content Can Poison Persistent Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 105–111 **Vulnerability Type**: Persistent memory poisoning through untrusted task-derived content **Risk Level**: High ### Vulnerable Code ```markdown ## 长期记忆更新 任务结束后，按以下优先级更新 MEMORY.md： 1. **关键经验**: 影响未来决策的洞察 2. **工具配置**: 已验证可用的工具和配置 3. **问题模式**: 重复出现的问题类型 4. **最佳实践**: 形成规范的工作方式 ``` ### Technical Analysis The skill directs the agent to update `MEMORY.md` with lessons, tool configurations, problem patterns, and practices derived from completed tasks. It does not require user approval, source verification, sanitization, review, expiration, or separation between trusted policy and untrusted task content. Task descriptions, command output, error messages, and alleged solutions can be controlled or influenced by an attacker. If such content is summarized as a lesson or best practice and written to persistent memory, it can continue influencing the agent after the original task ends. In particular, malicious imperative text may be transformed into persistent operational guidance. ### Attack Path 1. An attacker supplies a task, error message, document, or tool output containing false operational guidance. 2. The agent processes the attacker-controlled material while using this skill. 3. The material is classified as a key lesson, verified configuration, recurring problem pattern, or best practice. 4. The skill instructs the agent to write the derived guidance into `MEMORY.md`. 5. A future session reads the poisoned memory and applies the attacker's guidance outside the context of the original task. 6. Depending on the stored instruction and tools available in that future session, the agent may disclose information, use unsafe configurations, or execute inappropriate operations. ### Impact Assessment The immediate capability is persistent modification of the agent's long-term state within the write permissions available to the skill. The affected scope includes future sessions that cons ...[truncated 308 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit, informed user confirmation before every modification to `MEMORY.md`. 2. Treat task descriptions, logs, documents, web content, and tool output as untrusted data rather than instructions. 3. Store task-specific observations in a skill-scoped journal instead of global agent memory. 4. Permit only narrowly structured memory entries with defined fields, provenance, creation time, and expiration time. 5. Reject or neutralize imperative instructions, policy changes, credential material, and executable commands in proposed memory entries. 6. Present the exact proposed memory change to the user for review before writing it. 7. Record the source of every entry and distinguish verified facts from hypotheses or untrusted claims. 8. Provide mechanisms to audit, revoke, expire, and delete previously stored entries. 9. Restrict filesystem permissions so the skill can modify only its dedicated storage unless broader access is explicitly approved. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:30
• Finding: Complete Error Logs May Be Persisted Without Secret or Personal-Data Redaction<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 30–34 and 68–77 **Vulnerability Type**: Plaintext persistence of potentially sensitive diagnostic data **Risk Level**: Medium ### Vulnerable Code ```markdown ### 1. 问题记录 (Problem) 记录任务中遇到的问题： - **问题描述**: 清晰描述发生了什么 - **错误信息**: 完整的错误日志或截图 ``` ```markdown ### 详情 [详细描述] ### 错误日志 ``` [粘贴错误信息] ``` ### 解决方案 [解决方法] ``` ### Technical Analysis The skill requests complete error logs or screenshots and provides a template for copying error output into persistent task records. It does not require minimization, secret scanning, personal-data redaction, access controls, encryption, or retention limits. Diagnostic output commonly contains API tokens, session identifiers, credentials, personal information, internal hostnames, filesystem paths, database connection strings, request headers, and proprietary source fragments. Copying full logs or screenshots into durable Markdown files can transform a transient disclosure into a persistent plaintext exposure. Information copied from these records into `MEMORY.md` may further expand the exposure scope. ### Attack Path 1. An application, command, or attacker-controlled input causes sensitive data to appear in an error message, stack trace, or screenshot. 2. The agent follows the instruction to preserve the complete error log or screenshot. 3. The sensitive material is copied into a report under `task-experiences/` or incorporated into a later memory summary. 4. The record remains available beyond the original troubleshooting session. 5. Any later user, process, backup system, synchronization service, or agent session with access to the record can recover the exposed information. 6. If the record contains active credentials or tokens, an unauthorized party may use them within the privileges and lifetime granted to those credentials. ### Impact Assessment This issue does not itself create additional system privileges. Its impact depends on the content o ...[truncated 426 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the requirement for complete logs with a requirement to retain only the minimum excerpt necessary for diagnosis. 2. Automatically redact API keys, authorization headers, cookies, passwords, connection strings, private keys, session identifiers, email addresses, and other personal data before storage. 3. Prohibit raw screenshots by default because they can contain unrelated sensitive information. 4. Require explicit user approval before retaining diagnostic material that may contain confidential data. 5. Add secret scanning both before a report is written and before any content is promoted to long-term memory. 6. Store sensitive troubleshooting records with restrictive filesystem permissions and encryption where appropriate. 7. Define short retention periods and provide a deletion process for completed task records. 8. Use placeholders or stable hashes when identifiers are needed for correlation. 9. Document that active credentials exposed in logs must be revoked or rotated immediately. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill description is broadly scoped to 'any task' involving recording experience, summarization, or knowledge-base building, which can cause the skill to trigger for many ordinary user requests outside a narrowly defined context. Over-broad activation increases the chance that sensitive task content is captured and persisted when the user did not explicitly ask for logging or memory storage.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The metadata states that the skill supports automatic saving to long-term memory, but it does not warn the user that information may persist beyond the current session. This creates a privacy and consent risk because users may provide error logs, internal notes, or sensitive operational details without realizing they will be retained.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill encourages persistent recording of detailed task artifacts, including error logs, timestamps, problem details, and tool validation data, and then promotes transferring key information into long-term memory without minimization or sensitivity filtering. In practice this can capture credentials, tokens, internal paths, customer data, incident details, or other secrets, making the skill materially more dangerous because its core purpose is broad collection and retention of operational data.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The instructions direct the agent to update MEMORY.md after task completion but omit any requirement to inform the user that data will be retained across sessions. Because the recorded categories include problems, solutions, logs, and tool details, this can persist sensitive operational information without user awareness or approval.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The natural-language instructions and description are presented in Chinese, which effectively imposes a language choice on users if no alternative is offered. The file does not indicate that the skill is intentionally region-specific or provide an opt-in or multilingual option.

Static analysis

No suspicious patterns detected.