T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:85- Finding
Untrusted Migrated Content Can Poison Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
memo-bridge
Security checks for vulnerabilities and agentic risk
Overview
MemoBridge is a legitimate memory-migration skill, but it handles broad private AI context and can write imported content into persistent agent memory files without strong review boundaries.
Install only if you specifically need AI memory migration. Review the generated memo-bridge.md before sharing or importing it, prefer --dry-run and explicit --workspace paths, avoid auto-scanning broad directories, and do not import files from untrusted sources into persistent agent memory without manually checking for instruction-like or sensitive content.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)
other
Warning
- Location
SKILL.md:27- Finding
Broad AI Context Collection Creates a Plaintext Sensitive-Data Exposure Risk
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md | `--output <path>` | Output file path (default: `./memo-bridge.md`) | | `--input <path>` | Input file path | | `--dry-run` | Preview mode, no actual writes | | `--overwrite` | Overwrite existing files instead of appending | | `--verbose` | Detailed output | ## Extending with Custom Adapters
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger metadata is very broad and can activate on ordinary conversation about switching tools, sharing context, or moving preferences. Because this skill performs memory export/import operations that may access local files and create portable copies of sensitive context, over-triggering increases the chance of unintended data exposure or user-confusing execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explains convenience and preservation benefits but does not prominently warn that extraction may read local memory stores and produce transferable artifacts containing sensitive preferences, history, tokens, or project context. Users may therefore consent without understanding the privacy implications, especially when migrations involve sharing or moving data across tools and machines.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The 'When to Use' section expands activation to loosely defined situations like onboarding a new assistant or sharing AI context with a teammate, without requiring confirmation that the user wants memory extraction or transfer. In a skill that handles accumulated assistant memory, this ambiguity can lead to unnecessary invocation and accidental handling of sensitive data.
- Content
Static analysis
No suspicious patterns detected.