T09 · Insecure Skill Coding Practices
Error
- Location
packages/core/src/tools-logic/palace-write.ts:59- Finding
Path Traversal in Palace Read and Write Operations
- Content
View full analysis
- Remediation
View remediation
Security audit
AgentRecall
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent local memory tool, but it asks for persistent agent hooks and broad Claude transcript/config access that exceed its declared local-only storage scope.
Install only if you are comfortable with a local agent memory system that can persist prompts, corrections, project summaries, and cross-project insights. Prefer the basic MCP mode first, avoid automatic hooks and /arsaveall until you review the exact files they read, and do not curl command files from a mutable branch without pinning or verifying them. Back up ~/.agent-recall before using deletion or cleanup flows.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
README.md:181- Finding
Mutable Remote Agent Commands Installed Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
/commands/arstatus.md ``` 3. Publish expected SHA-256 hashes and verify each downloaded file before installing it. 4. Download to a temporary file, verify its integrity, display the source and destination, and only then atomically move it into `~/.claude/commands`. 5. Avoid overwriting existing command files without explicit user confirmation and create a backup before replacement. 6. Version command files together with the package release so that the installed instructions correspond exactly to the audited source version. 7. Document that Markdown command files are trusted executable instructions at the agent layer, even though they are not native binaries. 8. Consider signed release artifacts or repository release assets with signature verification for stronger provenance. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (407)
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 98% confidence
- Finding
Directly targeting
~/.claude/settings.jsonis dangerous because it accesses a high-trust agent configuration directory outside the skill's normal data area. Any automated change there can persistently alter host behavior, add hooks, or broaden the blast radius from one memory skill to the entire agent environment.- Content
md ### Files to change - `packages/cli/src/index.ts` — new `sync-memory` command - `~/.claude/settings.json` — add PostToolUse hook for session_end - `packages/core/src/tools-logic/session-start.ts` — check for AR-SYNC.md freshness ---
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
The README instructs users to modify
~/.claude/settings.jsonto wire automatic hooks that run on session and prompt events. Persisting executable hooks inside an agent config directory increases trust and execution scope, and in this skill's context those hooks capture prompts and write data automatically on future sessions.- Content
Automatic (Zero Discipline — Hooks)
Wire once in
~/.claude/settings.json. Every session is captured automatically, even without/arsave:json {
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
The Codex configuration instruction similarly directs users to install a persistent MCP integration in an agent configuration path. While not inherently malicious, persistent agent config changes raise risk because they extend future code execution and data access across sessions.
- Content
VS Code — .vscode/mcp.json
{ "servers": { "agent-recall": { "command": "npx", "args": ["-y", "agent-recall-mcp"] } } }
Codex — ~/.codex/config.toml
codex mcp add agent-recall -- npx -y agent-recall-mcp
text
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the implementation scans all project directories and builds project board or status reports, the skill is acting as a broader local data aggregator rather than only a memory tool. That makes the privacy impact larger because it may enumerate unrelated projects and infer status information not necessary for the advertised purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the implementation scans all project directories and builds project board or status reports, the skill is acting as a broader local data aggregator rather than only a memory tool. That makes the privacy impact larger because it may enumerate unrelated projects and infer status information not necessary for the advertised purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the implementation scans all project directories and builds project board or status reports, the skill is acting as a broader local data aggregator rather than only a memory tool. That makes the privacy impact larger because it may enumerate unrelated projects and infer status information not necessary for the advertised purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the implementation scans all project directories and builds project board or status reports, the skill is acting as a broader local data aggregator rather than only a memory tool. That makes the privacy impact larger because it may enumerate unrelated projects and infer status information not necessary for the advertised purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the implementation scans all project directories and builds project board or status reports, the skill is acting as a broader local data aggregator rather than only a memory tool. That makes the privacy impact larger because it may enumerate unrelated projects and infer status information not necessary for the advertised purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
If the implementation scans all project directories and builds project board or status reports, the skill is acting as a broader local data aggregator rather than only a memory tool. That makes the privacy impact larger because it may enumerate unrelated projects and infer status information not necessary for the advertised purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the implementation scans all project directories and builds project board or status reports, the skill is acting as a broader local data aggregator rather than only a memory tool. That makes the privacy impact larger because it may enumerate unrelated projects and infer status information not necessary for the advertised purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the implementation scans all project directories and builds project board or status reports, the skill is acting as a broader local data aggregator rather than only a memory tool. That makes the privacy impact larger because it may enumerate unrelated projects and infer status information not necessary for the advertised purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
If the implementation scans all project directories and builds project board or status reports, the skill is acting as a broader local data aggregator rather than only a memory tool. That makes the privacy impact larger because it may enumerate unrelated projects and infer status information not necessary for the advertised purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the implementation scans all project directories and builds project board or status reports, the skill is acting as a broader local data aggregator rather than only a memory tool. That makes the privacy impact larger because it may enumerate unrelated projects and infer status information not necessary for the advertised purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
If the implementation scans all project directories and builds project board or status reports, the skill is acting as a broader local data aggregator rather than only a memory tool. That makes the privacy impact larger because it may enumerate unrelated projects and infer status information not necessary for the advertised purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the implementation scans all project directories and builds project board or status reports, the skill is acting as a broader local data aggregator rather than only a memory tool. That makes the privacy impact larger because it may enumerate unrelated projects and infer status information not necessary for the advertised purpose.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill metadata promises 'local markdown only' and 'zero cloud, zero telemetry', but this command explicitly instructs the agent to push saved memory to GitHub. That creates a confidentiality and trust-boundary violation: persisted memory may contain user conversation summaries, intentions, corrections, and project details that the user did not expect to leave the local machine.
- Content
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 85% confidence
- Finding
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
- Content
md - **Insights should be reusable.** "Fixed a bug" is not an insight. "API returns null when session expires — always null-check auth responses" is an insight. - **Don't over-save.** 1-3 insights per session is plenty. Quality over quantity. - **Match the user's language.** If the session was in Chinese, write in Chinese. - **Checkpoint saves allowed.** Multiple saves per day merge into one journal entry. Don't refuse a save just because one already happened today. - **Use `remember` for manual fixes.** If session_end missed something, use `remember` to route it to the right store.
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill directs extraction and persistence of user-provided content from multiple session transcripts across projects, creating a cross-context data aggregation channel. This can leak sensitive material between otherwise separate workstreams and make accidental disclosure more likely in future recalls or displays.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Deriving and storing a user's underlying intention from early transcript messages increases sensitivity because intent often reveals private goals, internal plans, or confidential business context not needed for basic journaling. Persisting inferred intent in identity/palace files can amplify downstream privacy and inference risks.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Synthesizing summaries from prior session transcripts for un-journaled projects aggregates stored conversation content into new persistent artifacts. This increases the chance that confidential details are copied, normalized, and later surfaced outside their original context.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 98% confidence
- Finding
Directing the agent to cat a file under ~/.claude accesses the agent configuration/memory directory, a high-sensitivity location that may contain credentials, profile data, project mappings, or other privileged context. Even a read-only instruction is dangerous because it can exfiltrate or inappropriately blend sensitive configuration data into an unrelated task context.
- Content
bash # Layer 1: Claude AutoMemory (user profile + project pointers) cat ~/.claude/projects/-Users-tongwu/memory/MEMORY.md # Layer 2: AgentRecall palace identity (project intention + goals) cat ~/.agent-recall/projects/<slug>/palace/identity.md
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 85% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md - **Run /arstatus first if unsure.** If you don't know which project to load, run /arstatus to see the full status board, then come back here. - **Be fast.** Two tool calls: session_start + recall. Don't add extra calls unless recall returned 0. - **Don't lecture.** Show the card, offer insights, then get out of the way. - **Sparse data is fine.** New project with no palace, no journal — say so briefly and proceed. - **hook-start already ran.** At session start, a quick preview was auto-loaded. /arstart completes it with cross-project data, rooms, and task-specific recall. Don't re-explain what the hook already showed. - **Call check() before significant actions.** If you're about to do something irreversible (publish to npm, push to git, delete files, deploy), call `check(goal="<what you're about to do>", confidence="high")` first.
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The command is presented as a status/scan workflow, but it embeds destructive deletion behavior that removes entire project directories. Mixing read-only status functionality with deletion increases the chance that a user or agent invokes harmful actions in a context where they expect only inspection, especially because the same command also instructs non-interactive agents to proceed autonomously.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Using recursive shell deletion (rm -rf) in an agent skill is dangerous because path construction depends on a variable slug and a shell command, creating severe blast radius if the value is malformed, unexpectedly empty, or improperly escaped. Even if intended for legitimate cleanup, this pattern can wipe all stored project memory or more if path validation fails.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The explicit recursive deletion of ~/.agent-recall/projects// is inherently high risk because it permanently removes journals and palace data and could exceed that scope if slug handling is compromised. The context makes it more dangerous because it is embedded in a general status command rather than a dedicated maintenance workflow.
- Content
md **d<N> — Delete project (e.g. `d5`)** Map the number back to the slug. Ask for confirmation: "Delete **<slug>**? This removes all journals and palace data. Reply `d<N>` again to confirm." On second `d<N>`: run `rm -rf ~/.agent-recall/projects/<slug>/` and say "Deleted <slug>." On anything else: abort silently. If they press Enter or say "skip" — proceed without loading any project context.
Static analysis
Detected: suspicious.prompt_injection_instructions
Prompt-injection style instruction pattern detected.
Warn
- Code
- suspicious.prompt_injection_instructions
- Location
- packages/cli/README.md:560
Prompt-injection style instruction pattern detected.
Warn
- Code
- suspicious.prompt_injection_instructions
- Location
- packages/core/README-pre-redesign.md:560
Prompt-injection style instruction pattern detected.
Warn
- Code
- suspicious.prompt_injection_instructions
- Location
- packages/core/README.md:165
Prompt-injection style instruction pattern detected.
Warn
- Code
- suspicious.prompt_injection_instructions
- Location
- packages/mcp-server/README-pre-redesign.md:560
Prompt-injection style instruction pattern detected.
Warn
- Code
- suspicious.prompt_injection_instructions
- Location
- packages/sdk/README.md:560
Prompt-injection style instruction pattern detected.
Warn
- Code
- suspicious.prompt_injection_instructions
- Location
- README.md:691