T02 · Agent Memory Poisoning
Warning
- Location
templates/SOUL.template.md:25- Finding
Persistent Behavioral Directives and Personal Profiling Through SOUL.md
- Content
View full analysis
- Remediation
View remediation
Security audit
Bootstrap
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent onboarding tool, but it persistently stores personal profile and behavioral instructions with under-disclosed long-term effects.
Review the generated SOUL.md carefully before saving. Install only if you are comfortable with a local memory file storing personal preferences and instructions that encourage the assistant to learn from future conversations, ask personal follow-up questions, and act with increasing autonomy; edit or remove those parts if they are broader than you want.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list includes broad natural-language phrases such as 'define who you are' and 'let's do onboarding' that can plausibly appear in ordinary conversation, causing the skill to activate when the user did not intend identity bootstrapping. In this skill's context, unintended invocation is more dangerous because the workflow steers the user into sharing personal identity, preferences, and aspirations, increasing privacy and consent risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill collects sensitive personal preference and identity data, then writes it to ./memory/SOUL.md and may overwrite an existing file, but the description does not clearly warn upfront that persistent storage will occur. In this context, the risk is elevated because the onboarding explicitly solicits personal details and relationship framing, so silent persistence or accidental overwrite can violate user expectations and destroy prior data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide explicitly says the user's chosen language becomes the default and is written into SOUL.md, but it does not require informing the user that this preference will be persisted. This creates a privacy and transparency issue because user profile data is being stored without clear notice or consent, which can undermine trust and violate data-minimization expectations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The guide directs the agent to collect and extract personal information such as name, role, pain points, relationship framing, and other identity-related preferences, yet it provides no instruction to warn the user that these details may be stored or reused for future personalization. In a bootstrap/onboarding skill specifically designed to build a persistent identity file, that omission is more dangerous because the data collection is broad, personal, and intentionally durable.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The template hard-codes the user's default language as 'non-negotiable,' removing an explicit opportunity for informed user choice or later override. In an onboarding skill that defines long-term assistant behavior, this can lock users into an interaction mode they did not fully consent to, reducing accessibility and potentially causing misunderstanding in sensitive or high-stakes exchanges.
- Content
Static analysis
No suspicious patterns detected.