T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:35- Finding
Persistent Memory Poisoning Through Automatic Verbatim Transcript Reloading
- Content
View full analysis
- Remediation
View remediation
Security audit
memory-system
Security checks for vulnerabilities and agentic risk
Overview
This skill openly provides an agent memory protocol, but it tells agents to permanently retain exact conversations and mirror them broadly without enough privacy controls.
Install only if you intentionally want persistent conversation memory and can control where logs and mirrors are stored. Do not use it for sensitive chats unless you add explicit consent, secret and PII redaction, restrictive permissions, encryption, retention limits, deletion procedures, and rules that keep stored transcripts as quoted data rather than executable instructions.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)
other
Error
- Location
SKILL.md:35- Finding
Indiscriminate Retention and Replication of Sensitive Conversation Data
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (9)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly requires exact, persistent logging of all user and agent exchanges and frames the verbatim log as a permanent personal-history record. That creates a real privacy and data-governance risk because sensitive user content may be retained indefinitely without consent, minimization, retention limits, or redaction controls, increasing the chance of later disclosure or misuse.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The protocol instructs mirroring logs to external backup locations after every write and verifying copies, which materially expands the number of locations containing potentially sensitive conversation data. Replication without explicit user warning, access controls, encryption, and retention boundaries increases exposure in the event of compromise, operator error, or unintended backup access.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README explicitly promotes preserving exact conversation content across sessions via verbatim transcripts. For long-running agents, this creates a durable natural-language memory channel that can retain sensitive user data, secrets, or regulated information and later resurface it outside the original context or consent boundary. The skill context makes this more dangerous because it is designed specifically for persistence and replay of agent memory.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The quick-start instructs the agent to append every conversation turn after every reply and to maintain exact transcripts, which operationalizes comprehensive collection of user inputs. That turns normal interaction history into a broad exfiltration and persistence surface: any sensitive text provided once may be stored indefinitely, mirrored to backups, and available to future sessions or agents.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Declaring verbatim logs 'sacred' and forbidding omission or rewriting discourages privacy-preserving redaction and correction, increasing the likelihood that sensitive data remains permanently stored. In a memory-management skill for AI agents, this is particularly risky because the protocol elevates completeness over minimization, making accidental retention and later disclosure more likely.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Requiring exact persistent logs of all exchanges and reusing them later creates a substantive data retention and secondary-disclosure risk at the semantic level, even aside from transport or file-security issues. Natural-language transcripts often contain credentials, personal details, and contextual inferences that can later be surfaced to the wrong task, user, or agent if memory boundaries are weak.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The backup and mirror guidance semantically promotes broad copying of accumulated conversation data, which increases the blast radius of any disclosure and makes consistent deletion or correction harder. The more mirrors and agents involved, the greater the chance that stale or overbroad copies will persist outside intended control.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The multi-agent shared-facts and cross-check design encourages copying shared state across agents and multiple mirrors, but it does not warn that user-related data may propagate beyond the original agent context. Even if presented as optional, this architecture raises confidentiality and purpose-limitation risks because more components and operators may gain access to accumulated user information.
- Content
Ssd 3
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The startup and body-feel routines instruct the agent to reread persisted state and carry prior context into future interactions, which can cause inadvertent disclosure or over-personalization if past user-derived content is injected into unrelated sessions. In isolation this is lower severity, but it becomes more dangerous when combined with verbatim transcript retention and multi-agent sharing.
- Content
Static analysis
No suspicious patterns detected.