T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:17- Finding
Persistent Conversation Content Can Poison Future Agent Sessions
- Content
View full analysis
- Remediation
View remediation
Security audit
Auto Chatlog
Security checks for vulnerabilities and agentic risk
Overview
This skill should be reviewed carefully because it automatically persists and reloads chat memory and gives unsafe instructions about storing credential details in long-term Markdown files.
Install only if you intentionally want automatic cross-session memory. Before use, remove or change the credential-storage instructions, keep secrets out of MEMORY.md and daily files, review stored memory regularly, and avoid enabling scheduled execution unless the command and workspace path are fixed and trusted.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:31- Finding
Long-Term Plaintext Credential Retention in Agent Memory
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/memory_snapshot.js:41- Finding
Unvalidated Date Argument Allows File Creation Outside the Memory Directory
- Content
View full analysis
0) { recentTopics = recentFiles.map(f => { const content = fs.readFileSync(path.join(MEMORY_DIR, f), 'utf-8'); const firstLine = content.split('\n')[0] || ''; return ` - ${f}: ${firstLine}`; }).join('\n'); } const content = `# ${today} - 🐟 ## 近期上下文 ${recentTopics || ' （新用户、暂无历史）'} --- 今日对话内容将在此添加。 `; fs.writeFileSync(filePath, content, 'utf-8'); console.log(`[OK] Created ${today}.md`); return true; } ``` ```javascript function main() { const args = process.argv.slice(2); const dateIdx = args.indexOf('--date'); const today = dateIdx >= 0 && args[dateIdx + 1] ? args[dateIdx + 1] : getToday(); ensureDir(MEMORY_DIR); createDailyFile(today); printStatus(today); } ``` ### Technical Analysis The value supplied through `--date` is accepted without validation and is interpolated into a filesystem path: ```javascript path.join(MEMORY_DIR, `${today}.md`) ``` An input containing `../` components can cause the normalized destination to escape `MEMORY_DIR`. The script then passes that path to `fs.writeFileSync`. The existing-file check prevents overwriting an existing destination, reducing but not eliminating the risk. An attacker can still create a new Markdown file at an attacker-selected path if the parent directory already exists and the process user has write permission. The process does not gain e ...[truncated 1575 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个自动化的跨会话记忆系统：会话结束自动归档、启动自动加载、无需手动提醒即可保存聊天内容。实际代码仅实现了一个命令行快照初始化工具：创建当天 memory 文件、从近几天文件首行拼出简单上下文模板、并打印目录状态。它没有任何会话生命周期钩子、没有读取当前对话、没有提取关键信息、没有把会话内容写入 daily memory，也没有把近期记忆注入到启动上下文中。因此主用途与关键能力均与声明明显不符，属于实质性描述-行为不匹配。
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill claims automatic operation on every conversation and uses broad trigger concepts, without clear activation boundaries or explicit user consent. That makes it easy for the agent to persist or retrieve data unexpectedly, expanding collection beyond what the user reasonably intended.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs automatic reading and writing of persistent memory files on every conversation without a clear warning or informed consent flow. This creates a privacy and data retention risk because user content may be stored and reused across sessions without clear minimization or awareness.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill tells the agent to automatically persist user-supplied credentials and configuration into long-term memory files. In this context, persistent natural-language memory is especially dangerous because later sessions may retrieve or echo those secrets outside the original purpose, causing cross-session data leakage.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly tells the agent to store credential information in MEMORY.md while elsewhere warning not to record sensitive credentials, creating contradictory handling of secrets. Persisting credentials in long-term markdown memory creates a durable leakage surface across sessions, tools, backups, logs, and future prompts.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Directing storage of credential information in MEMORY.md without strong safety controls is a direct secret-handling flaw. Secrets written into conversational memory can later be surfaced unintentionally in prompts, summaries, indexing, backups, or to unrelated tasks.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The note says not to record sensitive credentials in memory files, but then carves out an exception for content already in MEMORY.md, effectively normalizing plaintext secret retention. This contradiction undermines the only stated safeguard and can lead operators or the agent to preserve exposed secrets indefinitely.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill content is written as if operation and interaction are expected in Chinese, using fixed Chinese trigger phrases and instructions, with no indication that users may choose another language. This can violate language-choice policy when the skill implicitly constrains behavior to a single locale without opt-in or justification.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Automatically loading recent memory files and archiving conversation data on every interaction creates persistent collection and reuse of user-provided data with weak minimization boundaries. In a memory skill, this context makes the issue more dangerous because the whole design normalizes broad retention and reuse across unrelated future conversations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file’s natural-language description, usage context, and later user-facing console output are written in Chinese, indicating the skill is effectively localized to a specific language by default. There is no opt-in, language selection, or justification that this is a China-specific or Chinese-only tool, which conflicts with the policy against forcing a specific language without user choice.
- Content