T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:61- Finding
Unvalidated Cross-Skill Memory Consumption
- Content
View full analysis
- Remediation
View remediation
Security audit
Ziwei Fortune — 紫微斗数命盘
Security checks for vulnerabilities and agentic risk
Overview
This skill is not malicious, but it automatically stores and reuses personal birth-profile data in local memory, including from another skill, without clear user confirmation or deletion controls.
Install only if you are comfortable with the agent storing your lunar birth date, birth time, gender, and derived chart information in a local MEMORY.md file and reusing similar data from a related fortune-hub memory file. Before use, consider asking the agent not to persist the data, to confirm any imported profile values, and to show or delete the memory file when you are done.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:69- Finding
Automatic Plaintext Persistence of Personal Birth-Profile Data
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs collection and storage of sensitive personal data—birth date, birth time, and sex—in MEMORY.md, but does not require clear user notice, consent, retention limits, or deletion controls. Because these attributes are persistent and highly identifying in context, they can be reused or exposed later without the user understanding that long-term storage is happening.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs the agent to automatically read from local and cross-skill shared memory and 'directly use' available user birth data without asking again. This creates a data retention and secondary-use risk: sensitive user attributes may be reused in later sessions or contexts without fresh consent, and data from another skill directory may be disclosed or relied upon unexpectedly.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill directs writing both raw sensitive attributes and derived profiling data into MEMORY.md for future use, including birth details and inferred chart information. Persistent storage of these data increases the blast radius of any later memory disclosure, and the derived profile may reveal intimate beliefs or personal traits beyond the original input.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The document is entirely in Chinese and states that all calculations must strictly follow this document, effectively making Chinese the required operating language/reference without offering any language choice. This can violate language/locale policy when users or downstream agents are expected to follow the skill but are given no opt-in or alternative locale.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file contains user-facing interpretive guidance exclusively in Chinese, and nowhere indicates that users can opt into another language or that the skill is intentionally limited to a Chinese-speaking audience. The policy requires flagging language or locale constraints when they are forced without user choice or clear justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The instructions prescribe a default Chinese narrative style and specific Chinese phrasing conventions, but do not indicate that users may choose another language or locale. Under the policy, forcing a specific language without opt-in can be a natural-language policy issue unless the locale restriction is clearly documented and justified.
- Content