T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:3- Finding
Autonomous Poisoning of Persistent Agent Instructions and Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
Auto Improve
Security checks for vulnerabilities and agentic risk
Overview
This skill is a self-improvement workflow, but it gives the agent broad authority to automatically rewrite persistent instructions and memory without clear user approval.
Install only if you intentionally want an agent to maintain its own long-term instructions, and prefer using it in a controlled workspace where every proposed change is reviewed before it can alter skills, AGENTS.md, SOUL.md, or memory files.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill description says it should be used whenever the agent 'should get smarter without being prompted,' which is an extremely broad auto-activation condition for a capability that reads memory and modifies skills/protocols. This can cause the agent to invoke self-modifying behavior in unrelated contexts, leading to unauthorized state changes, prompt drift, or persistence of bad instructions without explicit user consent.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs the agent to read learnings/memory and automatically apply changes to skills, system playbooks, and memory facts, including direct application of 'low-risk' changes, but provides no clear user warning, approval requirement, or integrity controls. In context, this is especially dangerous because it enables persistent self-modification and memory editing based on potentially untrusted prior outputs, creating a pathway for prompt injection persistence, corruption of agent behavior, and hard-to-audit configuration drift.
- Content