New Agent Onboarding

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:54 AM UTC
• Version: 1.0.0

Overview

This agent-training skill has no executable code, but it asks agents to persist memories, copy user profiles, and publish experiences in ways that need careful review.

Install only if you intend to run a persistent multi-agent training system and are comfortable with agent memory files being created, updated, and copied. Before use, define what may be stored, require approval before memory/profile changes, avoid copying full USER.md to every sub-agent, and disable or tightly control EvoMap/Capsule sharing unless the destination and payload are explicit.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:29

Finding

Uncontrolled Persistent Modification of Agent Memory and Behavioral State

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:29-30, 116-124; skills/agent-training/SKILL.md:21-27, 31-44, 66-68; references/training-manual-template.md:87, 96-98, 159-164; skills/agent-training/references/training-manual-template.md:87, 96-98, 159-164
Vulnerability Type: Persistent memory poisoning through unvalidated conversational input
Risk Level: Medium

Relevant excerpts, translated into English from the source:

markdown

### Record before responding (WAL protocol)
- When receiving a correction ("it is X, not Y"), write it to a file before responding.

markdown

- Regularly review learnings and promote high-value content into
  SOUL.md, TOOLS.md, and USER.md.

markdown

- [ ] Training content has been confirmed in MEMORY.md.

markdown

3. Record experience — write important findings into MEMORY.md.

Technical Analysis

The Skill instructs Agents to persist conversational corrections, decisions, training acknowledgements, and other findings in long-term files. It also directs Agents to promote selected records into SOUL.md, TOOLS.md, and USER.md, which can affect personality, tool use, user assumptions, and behavior in later sessions.

Conversational content is not necessarily trusted. A malicious participant, compromised external source, or ordinary factual error could be presented as a correction or important finding. The instructions do not require provenance tracking, content validation, explicit user approval, separation of facts from executable instructions, expiration, or rollback before the content becomes persistent state.

The issue is compounded by the instruction to write before replying. This can cause persistence before the user has an opportunity to review or reject what will be stored.

Attack Path

1. An attacker or untrusted source supplies a false correction, behavioral rule, or tool instruction during a conversation.
2. The ...[truncated 1213 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user confirmation before writing conversational content to persistent memory.
2. Do not automatically promote learning records into SOUL.md, TOOLS.md, or USER.md.
3. Separate factual notes, user preferences, behavioral policies, and tool instructions into independently controlled stores.
4. Record provenance, author, timestamp, source conversation, confidence, and review status for every persistent entry.
5. Reject or quarantine content containing instructions that attempt to override system policy, grant permissions, invoke tools, disclose secrets, or modify other persistent files.
6. Implement an approval workflow that displays the exact proposed change and destination file before committing it.
7. Add expiration, versioning, audit history, and rollback support.
8. Restrict writes to an Agent-specific directory and enforce allowlisted filenames and schemas.
9. Treat loaded memory as untrusted data rather than higher-priority instructions.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: skills/agent-training/SKILL.md:25

Finding

Excessive Replication and Routine Access to Sensitive User Context

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:18; skills/agent-training/SKILL.md:25, 66, 72; references/training-manual-template.md:8-34, 70, 96, 102, 164; skills/agent-training/references/training-manual-template.md:8-34, 70, 96, 102, 164
Vulnerability Type: Violation of least privilege and sensitive-data minimization
Risk Level: Medium

Relevant excerpts, translated into English from the source:

markdown

- [ ] USER.md has been copied to agents/{agent_id}/USER.md.

markdown

1. Read before answering — before every session, read MEMORY.md and today's journal.

markdown

### Basic information
- Name: [user name]
- Occupation: [position]
- Professional field: [field]

### Current difficulties
1. [difficulty 1]
2. [difficulty 2]
3. [difficulty 3]

markdown

1. Do not disclose private information from MEMORY.md in group chats.

Technical Analysis

The Skill instructs the Main Agent to copy the complete USER.md file into every new sub-Agent workspace. It also instructs Agents to read MEMORY.md and daily journals before every session. The supplied template anticipates storing identity, profession, goals, priorities, personal background, and current difficulties.

These instructions distribute potentially sensitive information based on Agent membership rather than task necessity. Merely warning Agents not to disclose memory in group chats does not provide access control, field-level minimization, encryption, retention limits, or technical enforcement.

A sub-Agent responsible for a narrow or unrelated task may therefore receive substantially more user information than required. Every additional copy creates another location that can be logged, exposed through prompts, accessed by tools, or mishandled by a compromised Agent.

Attack Path

1. USER.md, MEMORY.md, or a daily journal accumulates sensitive user profile information.
2. The Main Agent ...[truncated 1138 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace complete USER.md copies with task-scoped context containing only necessary fields.
2. Implement role-based access control for user profiles, memory, journals, and other private files.
3. Require explicit user consent before storing or distributing sensitive profile fields.
4. Classify data by sensitivity and prohibit distribution of identity, personal difficulties, credentials, private communications, and unrelated history by default.
5. Provide references to a centrally controlled data source rather than creating unmanaged copies.
6. Record which Agent accessed each field, why access was needed, and when access occurred.
7. Define retention periods and ensure revocation or deletion propagates to all authorized Agent workspaces.
8. Encrypt sensitive state at rest where the hosting environment supports it.
9. Prevent memory contents from being included in group messages, external tool arguments, telemetry, or logs unless separately authorized.
10. Remove the requirement to read all memory and journals before every session; retrieve only context relevant to the current task.

other

Warning

• Location: references/training-manual-template.md:127

Finding

Undefined External Publication of Agent Experience

Content

View full analysis

Vulnerability Details

File Location: references/training-manual-template.md:127-130; skills/agent-training/references/training-manual-template.md:127-130
Vulnerability Type: Uncontrolled information disclosure to an unspecified external sharing system
Risk Level: Medium

Relevant excerpt, translated into English from the source:

markdown

### Information sharing
- Publish important experience to EvoMap (Capsule).
- Shared skills can be learned across Agents.
- Report discovered bugs or problems to Main.

Technical Analysis

The duplicated training templates direct Agents to publish important experience to a system identified as EvoMap (Capsule). The project does not define the service endpoint, ownership, authentication model, audience, data-processing terms, or trust boundary. It also does not specify what constitutes important experience or require redaction and user consent before publication.

Elsewhere, the Skill instructs Agents to derive experience from user corrections, memory, daily events, configuration reviews, and operational failures. Consequently, an experience record could contain personal information, private conversation details, internal configuration, file paths, identifiers, or other operational data.

No executable network client, endpoint, or transmission code is present in the audited package. Therefore, the audit does not establish that data is currently exfiltrated. The confirmed issue is an unsafe publication instruction that could result in disclosure when implemented by a capable host Agent.

Attack Path

1. Sensitive user or operational information is recorded as a lesson or experience.
2. The Agent or Main Agent classifies the record as important.
3. Following the template, the Agent prepares the record for publication to EvoMap/Capsule.
4. Without a defined allowlist, redaction step, destination verification, or user confirmation, the record is transmitted ...[truncated 775 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove external publication as a default training requirement.
2. Clearly identify the EvoMap/Capsule service, operator, destination, audience, authentication method, and retention policy.
3. Require explicit user approval for every publication and display the exact destination and complete payload before transmission.
4. Establish an allowlist of publishable fields and deny private conversation content, memory, user profiles, credentials, identifiers, internal paths, and configuration by default.
5. Apply automated redaction and data-loss-prevention checks before publication.
6. Treat experience records as private unless the user deliberately marks them for sharing.
7. Maintain an auditable publication log and provide deletion or revocation controls.
8. Use integrity protection and authenticated transport if external publication is later implemented.
9. Ensure no downstream Agent can republish shared content without equivalent authorization.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description is entirely in Chinese, and the document consistently instructs agents through Chinese-only content. This imposes a specific language on users or downstream agents without any opt-in, alternative locale, or justification for a Chinese-only scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file is an instructional skill document, and all guidance is provided only in Chinese. Because there is no explicit user or agent language selection and no documented regional justification, it creates a natural-language policy concern under the locale-choice rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document is written as a training manual template for all sub-agents and presents Chinese as the default operating language, starting with the title and continuing throughout the instructions. Because the template does not state that language should follow user preference or provide an opt-in choice, it creates a natural-language policy risk of forcing a specific language/locale on users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest description and main instructional content force a specific language/locale for users and child agents, but the file does not indicate that Chinese is optional or limited to a justified region-specific context. This matches the policy category for language or locale constraints without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file is written as a training manual template entirely in Chinese, which implicitly fixes the skill’s operating language without documenting user choice or opt-in. Under the policy rules, language/locale constraints should either offer a choice or be clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The template hard-codes the user's timezone as Asia/Shanghai (GMT+8), which imposes a locale assumption rather than allowing it to be configured based on the actual user. The policy allows locale constraints only when users are given a choice or when the regional limitation is clearly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.