Memory Guardian

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:03 AM UTC
• Version: 1.1.0

Overview

The skill is a memory-maintenance helper, but it gives unsafe guidance to preserve credentials in permanent git-tracked memory and to delete session files without clear confirmation or rollback.

Do not install this skill as written unless you first change the memory policy: credentials should never be copied into markdown memory, archives, embeddings, or git history. Use it only for read-only health checks, and require explicit user review plus backups before any promotion, cleanup, deletion, recovery, or migration step.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:43

Finding

Plaintext Credentials Are Promoted to Permanent Git-Tracked Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:43-48 and supporting recovery documentation at SKILL.md:61-66
Vulnerability Type: Plaintext sensitive-data persistence
Risk Level: High

Vulnerable Instruction

markdown

## Promotion Protocol

Before deleting ANY session file, extract:
1. Credentials/keys → permanent (NEVER lose these)
2. Architecture decisions → permanent/business-strategy.md
3. Infrastructure changes → permanent/outreach-infrastructure.md
4. New project summaries → permanent/projects/[name].md
5. User preferences → permanent/user-system.md

The related recovery instructions establish that memory is tracked in Git:

markdown

## Emergency Recovery

Everything is git-tracked. If memory corrupts:
1. `git log memory/` → find last good state
2. `git checkout <hash> -- memory/` → restore
3. Rebuild MEMORY.md index from `ls memory/permanent/`

Technical Analysis

The promotion protocol explicitly instructs an agent to extract credentials and keys from temporary session files and place their values into permanent memory. The emergency-recovery section states that memory is Git-tracked.

This violates secure secret-management principles in two ways:

1. Sensitive values are deliberately persisted in ordinary memory documents rather than an approved secret manager.
2. Git may retain every committed version of those values in repository history, so deleting or redacting the current file does not reliably remove the secret.

The accompanying scripts/memory_check.py scanner does not identify, redact, encrypt, or otherwise protect secrets. Its integrity and duplicate checks hash complete file contents with MD5, but that hash operation does not protect the underlying plaintext files.

Attack Path

1. A user or integrated service provides an API key, password, access token, private key, or another credential during a session.
2. The credential appears in a session memory file.
3. Before stale-session cleanup, an age ...[truncated 1082 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction to copy credential values into permanent memory.
2. Replace it with a rule that memory may contain only a non-sensitive secret identifier, purpose, owner, and secret-manager reference.
3. Store secrets in an approved secret manager or platform credential store with encryption, access control, audit logging, rotation, and expiration.
4. Explicitly prohibit committing passwords, tokens, API keys, private keys, recovery codes, and credential-bearing configuration files to Git.
5. Add pre-commit, CI, and periodic repository-history secret scanning. Block commits when suspected secrets are found.
6. Apply restrictive filesystem permissions and repository access controls to memory data.
7. Redact sensitive values before writing session transcripts or memory documents.
8. If credentials have already been stored, revoke and rotate them first, then purge them from repository history and invalidate affected clones, caches, backups, and artifacts where feasible.
9. Add an automated check to memory_check.py that reports likely secrets without printing their values. Detection should complement, not replace, prevention and proper secret storage.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The code partially matches the declared description because it does perform memory-health-style checks: file size/line thresholds, stale file detection, duplicate detection, basic integrity/read-error detection, and orphan/index-reference checks. However, the declared purpose is substantially broader and emphasizes a full memory-management system for AI agents, including 3-layer architecture, memory promotion, context overflow prevention, vector-store migration triggers, and git-history recovery. None of those core capabilities are present in the provided code. The actual code is a read-only reporting utility over markdown files in a local workspace. This is a material description-to-behavior mismatch due to significant declared capabilities that are absent from the implementation.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instruction to preserve 'Credentials/keys → permanent (NEVER lose these)' normalizes storing secrets in long-lived memory files, increasing exposure through prompts, logs, file reads, version control, indexing, vector-store migration, and future retrieval by unrelated tasks. In this skill's context, the danger is amplified because the same document also recommends permanent retention, archival, semantic retrieval, and git-based recovery, all of which expand the blast radius of any secret stored there.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill references executable and repository-reading capabilities (python3 scripts/memory_check.py, git log, git checkout, ls memory/permanent/) but does not declare any explicit tool scope or permissions boundary. In an agent environment, this can lead to overbroad tool use, ambiguous authorization, and accidental access to files or environment data beyond what the skill actually needs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description says to use the skill whenever agents need memory protection, overflow prevention, promotion, cleanup, migration, or recovery, which is broad enough to encourage invocation in many contexts without clear guardrails. Over-broad activation criteria increase the chance that an autonomous agent will run cleanup or recovery actions inappropriately, especially around persistent memory stores.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The promotion protocol instructs deletion of session files after extracting selected information, but it provides no explicit user warning, confirmation step, backup requirement, or rollback validation before data removal. In an agent workflow, this creates a real risk of irreversible data loss, mistaken retention decisions, and accidental destruction of material that later proves important.

Content

No source excerpt is available for this finding.