T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:64- Finding
Untrusted Research Content Can Be Persisted into Agent Memory and Skills
- Content
View full analysis
scan_date: n ...[truncated 2970 chars]- Remediation
View remediation
Security audit
Curiosity Loop — Intrinsic Curiosity-Driven Continuous Learning
Security checks for vulnerabilities and agentic risk
Overview
This skill is not plainly malicious, but it should be reviewed because it directs the agent to persist learning data and modify memory or skills after researching external content without enough safeguards.
Review this skill carefully before installing. It is best used only if you explicitly want an agent to keep local learning records and propose or perform persistent memory and skill changes. Require confirmation before any memory write or skill patch/create action, restrict scan sources to trusted allowlisted feeds, treat all fetched content as untrusted, and avoid running the scanner from cron until the storage path and retention policy are clear.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (12)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is presented as a curiosity-driven learning loop, but it also defines persistent local state management and proactive network scanning behavior that materially expands its operational footprint. This mismatch can mislead reviewers and users about what the skill actually does, reducing informed consent and increasing the chance that background collection or network activity is enabled unexpectedly.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 97% confidence
- Finding
The skill explicitly instructs updating or creating skills based on its own research loop, enabling self-modification of agent behavior. Self-modifying mechanisms are dangerous because they can amplify mistakes, incorporate untrusted external content into future behavior, and bypass normal review workflows over time.
- Content
md --- name: curiosity-loop description: "Intrinsic curiosity-driven continuous learning: detect gaps between expected and actual results, treat them as curiosity signals, and update skills accordingly. Inspired by developmental AI from Flowers Lab, INRIA." version: 1.0.0 author: Guillaume D license: MIT
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 94% confidence
- Finding
The maintenance section normalizes patching the skill itself, reinforcing a self-modification workflow even if framed as upkeep rather than automation. In context of a learning loop, this increases the likelihood that behavior changes are made persistently without adequate security review.
- Content
md ## Maintenance ### When to patch this skill - If loop steps become redundant or obsolete - If new activation signals are discovered - If the delta tracking format changes
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes a capability centered on detecting expectation gaps and updating skills accordingly. In contrast, this file implements a source polling utility that reads a local config, fetches YouTube feed entries, prints results, and updates last-scanned dates, with no observable curiosity-signal detection or skill adaptation behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README defines automatic activation triggers in broad terms such as 'result delta,' 'sub-optimal approach,' and 'knowledge scan,' which can cause the skill to invoke in situations the user did not explicitly request. In a self-improvement skill, ambiguous triggers are especially risky because they can initiate research or skill-updating behavior without clear user intent or approval, increasing the chance of unintended actions and policy bypass through overbroad scope.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README instructs users to configure and run periodic scanning of external sources, but it does not clearly warn about outbound network activity, content ingestion risks, or possible privacy implications. Because this skill is designed for continuous learning, external scanning can introduce untrusted content into the agent's workflow and may expose usage patterns or local configuration context without informed user consent.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill describes capabilities that involve file reads/writes and network access, but it does not declare any tool scope or permission boundaries. That makes the effective authority of the skill ambiguous and can lead to overbroad execution in environments that rely on manifest-level restrictions for policy enforcement.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
The skill promotes progressive milestones and immediately follows with persistent delta tracking, indicating an intent to preserve learning state across sessions. Session persistence is not inherently unsafe, but here it contributes to durable accumulation of contextual interaction data and behavior adaptation without explicit boundaries or user consent.
- Content
md Structure learning as progressive milestones. - Identify missing prerequisites - Decompose the concept into progressive sub-concepts - Create verifiable milestones (can I explain this? can I use it?) ## Delta Tracking
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The design encourages durable logging of failures and learned facts into files and memory without any minimization, classification, or retention controls. In practice, this creates a systematic pathway for sensitive user inputs, operational details, and environment-specific data to be retained far beyond the original interaction.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs storing delta records in a persistent file under the user's home directory without warning that contextual data may be sensitive. Because delta entries include freeform context, expectations, and actual outcomes, the log can easily accumulate secrets, personal data, or proprietary information that remains on disk indefinitely.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The stated purpose emphasizes internal gap detection and continuous learning mechanics, but this code introduces a concrete external-content collection capability by querying YouTube channel feeds. Without manifest language declaring source crawling or external feed monitoring as part of the skill, this looks broader than the stated purpose.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This code overwrites /home/openfang/.hermes/deltas.json on every run by updating all last_scanned dates. While the module docstring mentions reading the file and outputting results, it does not disclose that execution will also modify persistent state, and there is no prompt or user-facing warning near the write operation.
- Content