Jobs to Be Done (JTBD)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:43 AM UTC
• Version: 1.0.5

Overview

The skill is mostly a normal product-strategy coaching guide, but it asks agents to write real-use observations back into the skill file, which can persist user/session content into future instructions.

Install only if you are comfortable preventing or reviewing edits to the skill file. Do not allow agents to paste raw customer, confidential, credential-like, or prompt-like text into SKILL.md; keep observations in a separate reviewed notes file instead.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:113

Finding

Uncontrolled Persistence of Session-Derived Content in Shared Skill Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 113
Vulnerability Type: Persistent agent memory poisoning through self-modification
Risk Level: Medium

Complete vulnerable snippet:

markdown

| *→ Add [O] entries here after each real use — paste the actual failure pattern* | *What went wrong and why* |

Technical Analysis

The instruction tells an agent to add observed entries to the shared skill after each real use and to paste the actual failure pattern. If an execution environment permits the agent to edit skill files, this creates an uncontrolled persistence channel from session input into a document that is subsequently loaded as agent instructions.

The instruction does not require explicit user or administrator consent, separation of data from executable instructions, content sanitization, provenance tracking, access controls, or review before persisted material is loaded in future sessions. An attacker could therefore craft a purported failure pattern containing instruction-like text. If copied into SKILL.md, that content could influence later agents whenever the skill is loaded.

This is classified as memory poisoning rather than ordinary note-taking because the proposed storage location is the persistent skill instruction file itself. The vulnerability depends on the hosting agent having permission and tooling to modify that file; this repository contains no script that independently performs the write.

Attack Path

1. An attacker invokes the skill in an environment where the agent can modify project files.
2. The attacker supplies a crafted scenario or alleged failure pattern containing adversarial instructions or sensitive information.
3. The agent follows line 113 and pastes the session-derived content into the shared SKILL.md table.
4. The modified skill persists after the current run.
5. A later agent or user loads the skill.
6. The persisted content is interpreted as ...[truncated 812 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction to modify SKILL.md after each use.
2. Keep observations in a separate data store that is never loaded as agent instructions.
3. Require explicit user or administrator consent before retaining session-derived information.
4. Apply data minimization and redact personal, confidential, credential-like, and proprietary content before storage.
5. Treat all retained text as untrusted data and prevent it from being interpreted as instructions.
6. Add provenance, timestamps, access controls, retention limits, and an approval workflow for shared observations.
7. If repository updates are necessary, require a human-reviewed change request rather than autonomous self-modification.
8. Restrict the runtime agent to read-only access to skill definitions under normal operation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.