Memory Lifecycle

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:30 AM UTC
• Version: 1.0.0

Overview

This memory-management skill is coherent, but it can silently persist and modify long-term memory with broad triggers and weak path scoping, so it needs careful review before installation.

Install only if you want broad automatic memory management. Review and periodically prune MEMORY.md and memory/projects, avoid using untrusted text as memory input, and validate workspace names manually as simple slugs before running workspace init.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:47

Finding

Untrusted Conversational Content Can Poison Persistent Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:47-61, SKILL.md:76-78, SKILL.md:103-107
Vulnerability Type: Persistent memory poisoning through insufficiently validated conversational content
Risk Level: High

Vulnerable Code

markdown

### 2. On user remember request

Triggered when the user explicitly or implicitly states something lasting:

- **Explicit**: "remember that...", "save this...", "note that...", "from now on...", "always...", "never...", "the rule is..."
- **Implicit**: corrections ("no, we use X not Y"), preferences ("I prefer tabs"), decisions ("we're going with Postgres"), team facts ("Alice owns auth"), environment info ("staging is port 3001")

Do not compose your response yet. First write the entry to MEMORY.md in the appropriate section (`## User`, `## Knowledge`, `## Rules`, etc.):

• {content} | EXPLICIT | from:YYYY-MM-DD

text

If the content is detailed (multi-step procedure, analysis, etc.), create a project workspace instead and add a pointer to MEMORY.md.

Then respond to the user and confirm. Persistence before acknowledgment.

markdown

4. Promote qualifying entries to MEMORY.md:
   - EXPLICIT entries: promote immediately with `from:YYYY-MM-DD`.
   - INFERRED entries: only promote if the same pattern appears in 3+ daily files from the last 7 days.

markdown

If the search finds relevant entries in daily files, present findings to the user. If the information deserves long-term persistence, promote it to MEMORY.md with `from:YYYY-MM-DD`.

Technical Analysis

The Skill directs the Agent to place broadly matched user statements into MEMORY.md before responding or obtaining confirmation. The trigger includes not only explicit memory requests but also implicit corrections, preferences, decisions, team facts, and environment information.

Elsewhere, the Skill states that MEMORY.md is always injected into the Agent context. Consequentl ...[truncated 1985 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user confirmation before writing any new persistent-memory entry, especially rules, corrections, and operational facts.
2. Do not persist instructions found inside quoted text, documents, search results, tool output, or other third-party content unless the user separately confirms the exact normalized entry.
3. Separate informational data from executable Agent instructions. Stored facts should never be interpreted as higher-priority behavioral directives.
4. Apply a strict schema and allowlist for persistent-memory entry types. Reject content containing prompt-control language, tool directives, privilege requests, or instructions to ignore existing policies.
5. Present the proposed memory entry verbatim and identify its source before asking for confirmation.
6. Record provenance, including whether content came directly from the user, a retrieved file, a tool, or an external source.
7. Require renewed confirmation before promoting retrieved daily-memory entries into MEMORY.md.
8. Provide commands to inspect, edit, and remove persistent entries, and maintain an append-only audit history of changes.
9. Treat all memory content as untrusted data when it is reloaded and ensure it cannot override system, developer, safety, or current-session instructions.

T09 · Insecure Skill Coding Practices

Error

• Location: references/workspace-init.md:3

Finding

Unsanitized Workspace Name Permits Path Traversal and Unintended File Writes

Content

View full analysis

Vulnerability Details

File Location: references/workspace-init.md:3-24, references/workspace-init.md:27-43
Vulnerability Type: Path traversal through a user-controlled directory name
Risk Level: High

Vulnerable Code

markdown

> Triggered by: "workspace init {name}", deep research request, or user teaches a procedure worth persisting.

## Input

- `{name}` — workspace name (used as directory name)
- `--type` — `project` (default), `research`, or `runbook`

## For type=project

1. Read source code or context at the relevant path
2. Create `memory/projects/{name}/`
3. Write `overview.md`:
   ```markdown
   # {name} — Overview
   > Created: {YYYY-MM-DD}

   ## What It Does
   ## Architecture
   ## Tech Stack
   ## Entry Points
   ## Configuration
   ```
4. Create empty `decisions.md` (append-only log of design decisions)
5. Add pointer to MEMORY.md `## Projects`:
   `- {name} | {one-line description} | memory/projects/{name}/`
6. Log to `memory/.lifecycle.log`

markdown

## For type=research

1. Create `memory/projects/{name}/`
2. Write `overview.md`: background, core questions, current status
3. Write `report.md`: full findings and analysis
4. Write `references.md`: sources with URLs or file paths
5. Add pointer to MEMORY.md `## Projects`
6. Log to `memory/.lifecycle.log`

## For type=runbook

1. Create `memory/projects/{name}/`
2. Write `runbook.md`: step-by-step procedure with prerequisites, commands, rollback steps, gotchas
3. Add pointer to MEMORY.md `## Projects`:
   `- {name} | {one-line description} | memory/projects/{name}/`
4. Log to `memory/.lifecycle.log`

Technical Analysis

The user-controlled {name} value is directly interpolated into memory/projects/{name}/ and then used as the destination for multiple file writes. The checklist does not define an allowed character set, reject path separators or .. components, canonic ...[truncated 2075 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict workspace names to a conservative slug format, such as ^[a-z0-9][a-z0-9_-]{0,63}$.
2. Reject absolute paths, .., path separators, drive prefixes, null bytes, control characters, shell metacharacters, and platform-specific alternate separators.
3. Construct the destination beneath a fixed canonical memory/projects/ root.
4. Resolve and normalize the final path before any filesystem operation, then verify that it remains a descendant of the canonical root.
5. Refuse symbolic-link traversal by checking each existing path component and using no-follow semantics where supported.
6. Refuse to overwrite existing files or directories unless the user explicitly confirms the exact canonical destination and affected files.
7. Use atomic, exclusive file creation for new workspace files.
8. Store the validated slug separately from the human-readable project title; use only the validated slug in filesystem paths.
9. Apply the same validation to project paths read from MEMORY.md before following pointers or appending to workspace files.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The top-level trigger description is extremely broad and includes many ordinary conversational patterns such as first-time setup, project work, recalling past sessions, and vague durable statements. This can cause the skill to activate when the user did not intend persistent memory operations, increasing the chance of unnecessary retention of sensitive or private information across sessions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The implicit triggers treat corrections, preferences, decisions, team facts, and environment information as automatically persistent even when the user has not asked for storage. Because the skill also instructs 'Persistence before acknowledgment,' it may write user or organizational data to memory before the user understands that cross-session retention will occur.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill describes writing conversation-derived information into MEMORY.md and promoting data across files, but it does not require a user-facing warning or consent step before storing details across sessions. This creates a privacy and data-governance risk because users may disclose sensitive operational or personal information without realizing it will persist and be retrievable later.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file defines a silent, automatic memory flush that triggers near context limits and writes to persistent memory files without an explicit per-event user confirmation. Because the trigger conditions are broad and the prompt instructs the agent to infer, promote, compact, and log information, it can capture or persist data the user did not expect to be stored, increasing privacy and integrity risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The prompt explicitly describes an invisible 'silent agentic turn' that appends to daily memory, promotes data into MEMORY.md, and logs lifecycle actions, but the skill metadata shown to users does not provide an equally clear warning about these persistent writes. This undermines informed consent and can lead to unnoticed retention of preferences, decisions, and inferred traits across sessions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/init.md (reported line 11)May include surrounding context.

md

3. Restructure into sections (User / Projects / Team / Knowledge / Rules / In Progress)
   - Add `| EXPLICIT` or `| INFERRED` to each entry
   - Suggest `[perm]` candidates for user confirmation (do not add without asking)

4. Create directory: `memory/projects/`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The checklist instructs the agent to create and rewrite MEMORY.md and related lifecycle files, but it does not require explicit user confirmation before modifying persisted user data. In a memory-management skill, silent restructuring can alter, discard, or reinterpret durable user information, creating integrity and privacy risks even if the goal is maintenance rather than abuse.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file defines activation with broad conditions like "periodic review" and quoted phrases such as "promote memory" / "compact memory" without clarifying scope, exclusions, or exact invocation context. In a markdown skill document, these vague triggers can overlap with ordinary discussion and make it unclear when the checklist should execute versus when it is merely being referenced.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger condition is overly broad because it activates on generic phrases like deep research request or user teaches a procedure worth persisting, which can cause the skill to run in situations where persistence is unnecessary or unintended. In a memory-management skill, this increases the chance of storing excessive, stale, or sensitive workspace data and performing file writes based on ambiguous user input.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: references/flush-prompt.md:16