project-keeper

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:04 AM UTC
• Version: 1.0.1

Overview

The skill is a project-memory helper, but it automatically creates persistent project records from ordinary project mentions without clear user opt-in, retention limits, or redaction rules.

Review before installing. This skill may be useful if you want durable project notes, but only use it if you are comfortable with project details being written to workspace files and reused later. Avoid storing secrets, tokens, private keys, sensitive internal paths, customer data, or instruction-like text that should not guide future agents. Prefer adding explicit confirmation, redaction, review, and deletion rules before use.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:2

Finding

Automatic Persistent Storage of Untrusted Project Information

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 2–12 and 52–53
Vulnerability Type: Persistent memory poisoning through automatic conversation-derived records
Risk Level: Medium

Vulnerable Instructions

markdown

## INIT
For this skill to work, create a "projects/" directory in your workspace. Inside will be a directory dedicated to each project you and your user mention and planning to/are work on. How these project files will be structured is explained in the following section 

## TRIGGER
Whenever a user mentions something about a new project that he is working on or planning to, keep in mind that he'll most likely mention it again. Instead of scrambling memory and past chats to scrape info, use this system

## FETCHING INFO
When a project's mentioned, first look if an existing project file is present. The file should have all critical info that would be important in future chats (such as the one you might be having now). The file would include where the project work file is sitting. 

## STORING INFO
### ONBOARDING.md
Once an unmanaged project is mentioned, it is critical that you create its respective project info file and store its mentioned info in a way that saves tokens, time and context while also having the ability to negate the need for a explanation from the user every time they reset the chat.

markdown

Think of this file as the onboarding and documentation of work for another agent (most probably your future self) who knows NOTHING about this project. Furthermore, try to extract info from the user about the details and focuses of this project if not mentioned and include them in their fitting sections.

Technical Analysis

The Skill instructs the Agent to create persistent project records whenever a project is merely mentioned. It does not require explicit user consent before creating or updating those records, define which information may be retained, establish a r ...[truncated 2449 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user confirmation before creating, updating, or loading a persistent project record.
2. Use a strict allowlist of fields that may be retained, rather than storing broadly defined “critical info.”
3. Exclude credentials, access tokens, private keys, personal data, and other secrets. Redact or generalize absolute local filesystem paths by default.
4. Store user-supplied text as clearly delimited quoted data with provenance metadata. Never treat text imported from records as Agent or system instructions.
5. Validate loaded records and ask the user to confirm consequential, stale, or instruction-like content before acting on it.
6. Provide record review, correction, deletion, and configurable retention controls.
7. Apply workspace permissions that restrict project records to the minimum necessary Agent and user scope.
8. Document that project records are persistent and may be reused in future sessions.
9. Add an explicit rule that records cannot authorize network transmission, command execution, credential use, or changes to safety constraints.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger activates on broadly defined mentions of a 'new project' or plans to work on one, which can cause the skill to run during ordinary conversation without clear user intent. In this skill’s context, that broad activation increases the chance of silently creating or consulting persistent records about user activities, making unintended data collection and storage more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill directs the agent to create a persistent 'projects/' directory and store project information, but it provides no user-facing notice that workspace files will be written or retained across chats. This is dangerous because users may disclose sensitive project names, paths, architecture details, or tokens without understanding that the information will be persisted locally.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill’s stated purpose is to preserve project details so users do not need to re-explain them after chat resets, which creates an intentional cross-session memory store in natural-language files. That persistence can expose sensitive project context to future sessions, other tools, or unauthorized readers of the workspace, especially because the example encourages storing architecture, locations, and authentication-related notes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly tells the agent to extract additional project details from the user and save them in structured files, again without warning about persistence or privacy implications. In context, this increases the chance of over-collection of sensitive implementation details, internal paths, network configuration, or credentials that may later be exposed or misused.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Encouraging the agent to proactively elicit more details and save them for 'future self' use creates an over-collection and downstream disclosure risk. The danger is heightened here because the skill frames persistence as beneficial convenience, which can normalize storing more project context than is necessary, including potentially sensitive operational details.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.