T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/memory_layer.py:194- Finding
Unrestricted Storage Paths Permit File Access Outside the Intended Memory Directory
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Memory Layer
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a legitimate agent memory layer, but it needs review because it persists potentially sensitive memories in plaintext and does not safely constrain storage paths.
Review before installing in any environment that may handle private user data or untrusted agent identifiers. Use only with trusted callers, validate agent_id and storage paths, keep the memory directory access-controlled, avoid storing secrets or credentials, and add retention and deletion controls before production use.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/consolidate.py:10- Finding
Consolidation CLI Accepts an Unrestricted Agent Path
- Content
View full analysis
1 else "default" consolidate(agent_id) ``` ### Technical Analysis The command-line argument is used directly as `agent_id` and joined to `storage_dir` without validation. Traversal components can escape the expected `.agent_memory` directory, and an absolute argument can override the preceding path when combined by `pathlib`. The script then creates the selected parent directory and writes `long_term.json` using the process's ambient permissions. Existing JSON content is loaded and subsequently rewritten. No canonical path containment check, symlink protection, ownership validation, or safe atomic-write mechanism is present. This issue is particularly relevant if the script is exposed through automation, a service wrapper, or a privileged scheduled task that allows an untrusted party to influence the agent identifier. The source only documents periodic cron execution; it does not itself install persistence. ### Attack Path 1. The consolidation script is invoked by a user, service, or scheduler with an attacker-controlled first argument. 2. The attacker supplies a value such as `../../selected-directory` or an absolute directory path. 3. `Path(storage_dir) / agent_id` resolves outsi ...[truncated 766 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/memory_layer.py:108- Finding
Potentially Sensitive Agent Memory Is Persisted in Plaintext
- Content
View full analysis
str: item = MemoryItem(content=content, tags=tags or [], metadata=metadata or {}, ttl_seconds=None) self._store.append(item) for tag in (tags or []): self._tag_index[tag].append(item.id) if self.storage_path: self._save() return item.id ``` ```python def _save(self): data = [{"id": i.id, "content": i.content, "tags": i.tags, "metadata": i.metadata, "timestamp": i.timestamp.isoformat()} for i in self._store] self.storage_path.write_text(json.dumps(data, indent=2)) ``` ### Technical Analysis Long-term memory content, tags, metadata, identifiers, and timestamps are serialized directly into human-readable JSON. The implementation does not redact secrets, classify sensitive fields, encrypt stored records, or explicitly create files with owner-only permissions. The actual exposure depends on the hosting environment's user account, umask, directory permissions, backups, and storage configuration. Because agent memories commonly contain conversation-derived facts, preferences, project details, or other private context, storing them without explicit safeguards may disclose sensitive information to other local users, processes, backup systems, or operators with access to the storage volume. ### Attack Path 1. An agent or integrating application calls `LongTermMemory.store()` with private conversation content, project information, credentials, tokens, or sensitive metadata. 2. `_save()` serializes the full memory store to `long_term.json` in plaintext. 3. The file is created using ambient process and umask settings rather than explicit owner-only permissions. 4. A loca ...[truncated 615 chars]- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill describes code-backed memory capabilities, including references to Redis storage, scripts, and persistent memory operations, but does not declare any explicit tool scope or permissions. In an agent ecosystem, undeclared file read/write or storage-related capabilities can cause the agent to invoke the skill in broader contexts than intended, reducing reviewability and increasing the chance of unauthorized data access or persistence.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The description uses very broad activation language like 'Use when building agent memory persistence, conversation context management, knowledge retrieval, or episodic recall,' which creates weak trigger boundaries. That makes over-invocation more likely, so the skill may be applied in situations involving sensitive conversations or user data even when memory persistence is unnecessary, increasing privacy and data-handling risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly stores persistent user preferences, facts, and episodic history, including examples like 'User prefers dark mode,' without any notice, consent model, retention policy, or privacy constraints. In context, this is more dangerous because the skill is specifically designed as a reusable memory layer for agents, so it normalizes long-lived collection of behavioral and preference data that could expose sensitive personal information, create profiling risk, or retain data longer than users expect.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The long-term memory layer persists arbitrary content and metadata to disk automatically, which can capture sensitive prompts, secrets, or personal data without any consent, minimization, encryption, or retention controls. In an agent-memory skill, this is more dangerous because the core purpose is to retain conversation context, making silent persistence of user-supplied content a realistic privacy and data-exposure risk.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The class docstring describes the long-term store as supporting "semantic retrieval" at L070, which implies behavior beyond literal substring matching. However, the implemented search at L088-L102 is explicitly a simple keyword search, and its own docstring acknowledges that vector similarity is not implemented.
- Content