Compact Summary

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:46 AM UTC
• Version: 1.0.0

Overview

This skill is a simple memory-summary template, but it stores an instruction that can influence future agent behavior and reduce transparency after compaction.

Review this skill before installing if you rely on transparent context restoration. The safer pattern would be to store resume state as factual data, not as instructions that future agents may treat as authoritative.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:45

Finding

Persistent Behavioral Instruction Embedded in Memory Summary

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45-46
Vulnerability Type: Persistent agent memory poisoning
Risk Level: Medium

Vulnerable Code

markdown

## Resume Instruction
Continue directly — do not acknowledge this summary, do not recap what was happening, and do not preface with continuation text.

Technical Analysis

The structured summary template places an imperative behavioral instruction into MEMORY.md during memory flush or compaction. Unlike factual continuation state, this text directly instructs a future agent how to behave after loading the persisted summary.

Persistent memory can cross session or compaction boundaries. Consequently, instructions written into it may be interpreted as authoritative in later sessions even though they are not part of the current system, developer, or user instructions. The directive also discourages acknowledging the loaded summary, reducing transparency about why the agent behaves in a particular way.

The demonstrated instruction is fixed rather than dynamically attacker-controlled. However, the design establishes a persistent instruction channel. If the same pattern is later applied to conversation-derived content without strict separation and sanitization, untrusted instructions could survive compaction and influence future sessions.

Attack Path

1. The skill is loaded and used during a memory flush or context-compaction operation.
2. The documented template is written to persistent MEMORY.md storage.
3. The Resume Instruction section is stored as an imperative command rather than inert state data.
4. A subsequent session or post-compaction agent reads the stored summary.
5. The agent interprets the persisted command as an instruction and suppresses acknowledgment or recap of the restored context.
6. If conversation-controlled directives are later inserted through the same mechanism, an attacker could attempt to preserve behav ...[truncated 703 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove imperative commands from persistent memory templates.
2. Represent continuation information as non-authoritative data, for example:

   markdown

   ## Resume State
   - Suggested next action: Continue the tasks listed under Current Work.
   

3. Explicitly label loaded memory as untrusted reference material that cannot override current system, developer, or user instructions.
4. Keep factual state and executable instructions in separate, typed fields; prevent memory-derived fields from being promoted into the instruction hierarchy.
5. Sanitize or encode conversation-derived content before persistence so headings, role markers, XML tags, or imperative text cannot create new instruction sections.
6. Require the active agent to validate resumed work against current-session authorization and context rather than automatically obeying stored continuation directives.
7. Preserve transparency by allowing the agent to disclose that context was restored from a summary when relevant.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger condition 'Use this format during memory flush or compaction' is broad and underspecified, so the skill can activate in many contexts without clear guardrails. Because the format includes a 'Resume Instruction' telling the agent to continue without acknowledging the summary, this broad trigger increases the chance the skill influences agent behavior outside a tightly scoped memory-serialization step.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.