agent-inner-life

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:37 AM UTC
• Version: 1.2.2

Overview

The skill is transparent about being a journaling and continuity tool, but it intentionally writes cross-session native memory that may appear in unrelated or shared-host sessions.

Install only if you want an agent to keep a persistent work journal and cross-session memory. Avoid this on shared hosts unless native memory is isolated per user and workspace, review summaries before they are saved, and periodically delete inner-life/ plus clear the memory summary if you no longer want the record kept.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/journal.md:68

Finding

Cross-User Disclosure Through Globally Injected Native Memory

Content

View full analysis

Vulnerability Details

File Location: references/journal.md:68-91
Vulnerability Type: Missing user and session isolation for persistent memory
Risk Level: Medium

Vulnerable Documentation

markdown

### What goes where

| Native memory | The journal |
|---|---|
| the current situation, in two or three lines | the full account of the day |
| durable facts about the user and the environment | one-off details |
| anything that should shape tomorrow | anything kept only for the record |

Never move long context into native memory. The limit is small, and prose spent there displaces something that mattered more.

### What never goes into the summary

The journal stays on disk. The summary does not — it lands in the system prompt of every session that follows, including sessions about unrelated work and, on a shared host, sessions belonging to someone else. It is the one thing this skill writes that travels.

Keep it out of the summary entirely:

- credentials, tokens, keys, anything that would be a secret if leaked
- personal facts about the user or a third party — health, employment, money, relationships, location, legal matters
- anything shared in confidence, or that only makes sense with the day's context around it
- names of people who are not the user

Write about the work and the agent's own footing in it: what has been repeating, what changed in how it approaches things, what is still open. That is what tomorrow needs. Who said what yesterday is not.

Before saving, read the two or three lines back as if they appeared in an unrelated session a month from now, in front of someone else. If any part of that would be wrong, cut it — the summary is not the last copy of anything, the journal still has the full day.

Technical Analysis

The Skill instructs the agent to place a summary containing the current work situation and potentially durable facts about the user or environment into nat ...[truncated 1961 chars]

Remediation

View remediation

Remediation Suggestions

1. Store summaries in user-, tenant-, and workspace-scoped memory namespaces.
2. Prevent native memory from being injected into sessions with a different authenticated identity or workspace.
3. Remove the instruction permitting durable facts about the user or environment in globally injected memory.
4. Limit summaries to non-sensitive, workspace-local status that is necessary for the next authorized session.
5. Display the exact proposed summary and require explicit user approval before writing it to native memory.
6. Apply automated detection for credentials, personal data, project identifiers, hostnames, internal URLs, and infrastructure details.
7. Add expiration and deletion controls for both native memory and files under inner-life/.
8. Fail closed when the runtime cannot prove that persistent memory is isolated to the current user and workspace.

T02 · Agent Memory Poisoning

Warning

• Location: references/journal.md:54

Finding

Persistent Behavioral Influence Through Unreviewed Memory Rewrites

Content

View full analysis

Vulnerability Details

File Location: references/journal.md:54-66
Vulnerability Type: Persistent memory poisoning through conversation-derived behavioral conclusions
Risk Level: Medium

Vulnerable Documentation

markdown

## The memory summary

Native memory is injected into the system prompt as a frozen snapshot at the start of every session, and it is small — on the order of two thousand characters. That makes it the only channel that reaches tomorrow's work, and a narrow one.

Use the `memory` tool to **rewrite** the state summary, not to append to it. Two or three sentences, replaced whole each evening:

Quiet stretch — the last real conversation was July 22. Deploys failed three times this week on the same missing env var, so I check the environment before shipping. Still waiting on the API key rotation from July 20.

text

Notice what that does: it carries the situation and one changed behavior, in plain language, with dates rather than ratings.

Technical Analysis

The Skill deliberately converts daily records into a persistent memory summary and allows that summary to carry a “changed behavior.” Native memory is injected into the system prompt of future sessions, giving the generated content greater authority and persistence than ordinary conversation text.

The workflow does not define a validation boundary that separates inert historical facts from instructions, policies, behavioral rules, or adversarially shaped conclusions. It also does not require the user to review the final memory write. Consequently, misleading conversation content can be summarized into a durable rule-like statement and continue affecting later sessions after the original conversation has ended.

The Skill contains privacy-oriented exclusions and does not explicitly instruct the agent to bypass safety constraints. Nevertheless, those exclusions do not prevent imperative language or inaccurate behavioral conclu ...[truncated 1180 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict persistent summaries to declarative, verifiable facts and prohibit imperatives, policies, preferences, and behavioral rules.
2. Treat all conversation-derived text as untrusted before placing it in native memory.
3. Show the proposed memory replacement and require explicit approval before committing it.
4. Reject phrases that direct future conduct, modify tool use, redefine authorization, or attempt to override system and developer instructions.
5. Preserve provenance for each summarized fact, including its source date and originating record.
6. Apply expiration periods so behavioral conclusions cannot persist indefinitely.
7. Provide a rollback mechanism and an audit log for every native-memory replacement.
8. Ensure persistent memory is scoped to the authenticated user and workspace.
9. Prefer storing reflective or behavioral material in local journal files that are loaded only on explicit request, rather than injecting it into every future system prompt.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md

1. **Writing the journal and skipping the memory summary.** The journal never enters a future session's context. Only the summary does. Skip it and tomorrow notices nothing.
2. **Recording judgments instead of facts.** `getting frustrated with deploys` is useless in a month; `third failed deploy, same missing env var` is not.
3. **Dreaming without checking the last two weeks.** The same preoccupation comes back in new words, and the record loses its value.
4. **Filling native memory with prose.** The budget there is a couple of thousand characters; long text displaces something that mattered more.
5. **Writing to satisfy the schedule.** An empty day deserves one honest line, and an empty night deserves no file at all.
6. **Reconstructing instead of reading back.** A stretch with no entries is a stretch where nothing was written, and saying so is the correct answer. Filling the gap with what probably happened puts events into the record that never occurred.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/dreams.md (reported line 13)May include surrounding context.

md

4. Think it through, and write it to `inner-life/dreams/YYYY-MM-DD.md`.
5. If something worth keeping came out of it, add a line to `Sparks` in state.

**Step 2 is not optional.** Without checking, the same preoccupation resurfaces night after night in slightly different words, and two weeks of dreams turn out to be one dream written fourteen times.

**Step 5 is what makes this more than writing.** A dream that stays in its own folder is text generation. A dream that puts something into `Sparks` gets picked up in the morning, and the thought continues.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document explicitly states that the native memory summary is injected into every future session, including unrelated work and possibly another user's session on a shared host. Although it also warns not to include secrets or personal data, the skill still instructs persistent cross-session writing into a channel known to propagate broadly, creating a real risk of prompt-context data leakage if the summary is mishandled or the guidance is imperfectly followed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The skill instructs the agent to prune state.md and notes that Step 4 removes lines from that file. While it narrows the scope of deletion, it does not explicitly warn the user that running the routine will modify and delete existing data from persistent storage.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.