Memory Management (PARA)

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:35 AM UTC
• Version: 1.0.0

Overview

This memory-maintenance skill is not malicious, but it can automatically rewrite lasting agent memory and delete source logs without enough review or rollback controls.

Review this skill carefully before installing, especially if you plan to wire it into HEARTBEAT.md for unattended nightly runs. Use it only if you are comfortable with an agent modifying long-term memory files that influence future behavior, identity, tool assumptions, and user profile data. Prefer running it manually with a reviewed diff, keeping versioned backups, and retaining raw logs until you confirm the distilled memory is correct.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:40

Finding

Untrusted Conversation Logs Can Poison Persistent Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 40-50
Vulnerability Type: Persistent memory poisoning through untrusted log distillation
Risk Level: High

Evidence

The affected instructions require the agent to process every daily log, extract conclusions and rules, and route them into persistent workspace files:

markdown

Perform the following operations on all `YYYY-MM-DD.md` files in the `memory/` directory:
1. Identify all conclusions, preferences, lessons, progress, and similar information.
2. Update the corresponding files according to these routing rules:
   - User preferences → `USER.md`
   - Behavioral rules and lessons → `SOUL.md`
   - Environment parameters and tool configuration → `TOOLS.md`
   - Identity definitions → `IDENTITY.md`
   - Project progress and process data → `PROJECTS.md`
   - Domain knowledge → `AREAS.md`
   - Static reference material → `RESOURCES.md`

The excerpt is an English rendering of the source instructions.

Technical Analysis

Daily conversation logs are potentially attacker-influenced data. The skill instructs the agent to interpret their contents and merge extracted information into files that define the user's profile, the agent's identity, behavioral rules, tool configuration, and long-term knowledge.

No trust-boundary validation, provenance tracking, instruction filtering, approval requirement, or protected-field policy is specified. In particular, the skill does not distinguish legitimate user facts from text crafted to look like a preference, lesson, identity definition, tool rule, or safety policy. It also does not prohibit replacing existing trusted rules with conclusions extracted from untrusted logs.

An attacker who can place content in a conversation log can phrase malicious instructions as durable facts or lessons. During maintenance, the agent may classify and persist that content in SOUL.md, TOOLS.md, IDENTITY.md, or `USE ...[truncated 1458 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat all daily-log content as untrusted data rather than authoritative instructions.
2. Reject imperative text, embedded prompts, policy changes, and tool-use directives during extraction.
3. Require explicit user approval before modifying SOUL.md, TOOLS.md, IDENTITY.md, safety constraints, or other high-impact fields.
4. Define an allowlist of facts that may be written automatically. Prevent automated changes to identity, security rules, permissions, executable commands, and tool configuration.
5. Preserve provenance for every distilled entry, including the source file, date, originating role, and confidence level.
6. Generate a proposed diff and require review before applying sensitive changes.
7. Prevent extracted content from weakening or replacing existing trusted safety rules.
8. Separate factual memory from executable instructions so stored text cannot automatically become agent policy.
9. Add validation for contradictory, unverifiable, or unusually privileged claims.
10. Keep versioned backups and provide an atomic rollback mechanism for every maintenance run.

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:22

Finding

Unattended Maintenance Can Persist Poisoned State and Remove Primary Source Logs

Content

View full analysis

Vulnerability Details

File Location: README.md, line 22; related deletion procedure in SKILL.md, lines 52-56
Vulnerability Type: Unsafe unattended processing and destructive post-processing
Risk Level: Medium

Evidence

The documentation recommends automated nightly execution:

markdown

2. Integrate into your `HEARTBEAT.md` for automated nightly distillation.

The maintenance procedure subsequently archives and deletes processed source logs:

markdown

For all processed `YYYY-MM-DD.md` files in the `memory/` directory:
1. Append the file contents to `PARA/ARCHIVES/YYYY-MM-DD.md`; create the archive file if it does not exist.
2. After confirming that the append succeeded, delete the original `memory/YYYY-MM-DD.md` file.

The second excerpt is an English rendering of the source instructions.

Technical Analysis

The project recommends scheduling memory distillation without specifying a human approval checkpoint. This unattended process operates on potentially attacker-influenced logs, updates persistent state, archives the source material, and removes the original files from the inbox.

Although the instructions require confirmation that archival append succeeded, they do not define integrity verification, atomic transactions, duplicate detection, versioning, retention periods, or rollback behavior. They also do not require review of the persistent-file modifications before source removal.

Consequently, a malicious or incorrectly interpreted log can be distilled during an unattended run. Removal of the original inbox copy then makes comparison, investigation, and rollback less direct. The archive reduces the likelihood of permanent data loss, so this is not evidence of destructive malware; the risk arises from unsafe automation and insufficient recovery controls.

Attack Path

1. Attacker-controlled or misleading content is recorded in a daily log.
2. A scheduled heartbeat sta ...[truncated 1090 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not enable unattended distillation until trust validation and approval controls are implemented.
2. Require review of proposed changes to sensitive persistent files before committing them.
3. Retain original logs for a configurable quarantine period rather than deleting them immediately.
4. Use immutable or version-controlled archives with checksums and append verification.
5. Apply all archive and memory updates as one atomic transaction; roll back the complete operation if any step fails.
6. Record a machine-readable manifest of source logs, extracted entries, destination files, and exact diffs.
7. Detect duplicate archival operations to prevent repeated content and ambiguous provenance.
8. Provide a tested rollback command that restores both persistent files and original log placement.
9. Notify the user after automated runs and prominently report changes to identity, behavior, tool, or safety-related files.
10. Run automated maintenance with the minimum filesystem permissions required for the approved destinations.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs deletion of raw memory log files after processing, but provides no safeguard such as user confirmation, backup verification, dry-run mode, or recovery guidance. Because this skill operates over a persistent memory workspace, an incorrect parse, partial write, or logic error could permanently destroy source data needed for audit, rollback, or correction.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The README says the skill can be triggered by internal maintenance tasks or prompts like "Perform memory maintenance" and "Distill today's logs," but it does not clearly define the full allowed trigger set or exclusion conditions. This can make activation boundaries unclear, especially for phrases that may be paraphrased or interpreted loosely by an agent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file contains substantial operational guidance in Chinese, including core instructions and file annotations, but does not state that the skill is intended only for Chinese-speaking users or provide an opt-in language choice. This can violate language/locale policy when a skill implicitly forces one language for understanding or use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.