T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:61- Finding
Persistent Storage of User-Controlled Behavioral Rules
- Content
View full analysis
- Remediation
View remediation
Security audit
feedback-loop
Security checks for vulnerabilities and agentic risk
Overview
This skill is a feedback-memory tool, but it can persist user feedback into agent behavior files and overwrite workspace agent instructions in ways that need review before installation.
Install only if you want this skill to make durable changes to your agent's memory and workspace instruction files. Review and constrain writes to AGENTS.md, MEMORY.md, memory/conclusions.md, and feedback-log.md, and avoid storing secrets, personal data, safety-policy changes, or broad tool-use instructions as feedback memory.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)
T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:9- Finding
Self-Declared Instruction Precedence Over Host Agent Configuration
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README explicitly promotes turning user feedback into long-term memory and writing it through a persistent chain of files, but it does not warn about privacy, retention, consent, or the risk of storing sensitive or adversarial user content. In an agent skill, persistent memory materially changes the security boundary: casual chat feedback can become durable behavior-shaping state, enabling privacy leakage, prompt-injection persistence, and unwanted policy drift.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest description and the full skill instructions are written to prescribe behavior entirely in Chinese, with no indication that the user may choose another language or locale. This creates a natural-language policy concern because it implicitly enforces a specific language for operation without documented opt-in or justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill instructs writing user feedback and derived conclusions into multiple local files, but the upfront description does not clearly and explicitly warn users about the breadth of persistence. This creates a consent and privacy risk because users may believe they are giving ephemeral feedback while the system stores it across workspace, memory, and retrieval layers for later reuse.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill mandates cross-file, cross-session persistence and later retrieval of user feedback, conclusions, and behavioral rules. That creates a durable memory channel that can retain sensitive, contextual, or mistaken user data and resurface it later, potentially affecting future responses or leaking information across tasks if access boundaries are weak. The explicit redundancy into multiple files and retrieval verification makes the persistence especially sticky.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill goes beyond passive feedback logging and instructs the agent to create git snapshots and perform rollback operations on the workspace. That expands its authority from note-taking into repository state management, which can alter unrelated files, overwrite user work, or revert changes without clear task-scoped consent. In this context, a feedback skill should not be issuing version-control commands as part of its normal flow.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file claims the skill does not call external scripts, yet it explicitly directs execution of git commands elsewhere. Even if git is not an external script per se, this is materially misleading because the skill still causes command execution and repository mutation, reducing operator awareness of its true behavior and increasing the chance of unsafe use.
- Content