T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:95- Finding
Untrusted User Content Can Poison Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
Memory Strategy
Security checks for vulnerabilities and agentic risk
Overview
This memory skill is not overtly malicious, but it needs Review because it can silently persist conversation content, store API keys in plaintext memory files, and send text to an external scoring API without clear consent controls.
Install only after reviewing whether you want automatic conversation memory at all. Do not store API keys, tokens, passwords, private keys, or sensitive personal data in this memory system. Use explicit approval before long-term writes, disable silent auto-write unless you trust the workflow, and avoid Kimi/API scoring for confidential text unless you have a clear privacy agreement and redaction process.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:122- Finding
API Keys Are Designated for Plaintext Persistent Markdown Storage
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:76- Finding
Potentially Sensitive Conversation Text Is Sent to an External Scoring API Without Privacy Controls
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The activation conditions are broad natural-language phrases like '记下来' and '回忆一下', plus operational conditions such as end-of-session archiving, which can cause the skill to run when the user did not intend durable storage. In a memory-management skill, unintended invocation directly increases the chance of persisting sensitive conversation content without meaningful user consent.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The overview presents automatic memory, scoring, decay, and silent archival as core features but does not provide a clear warning that user conversation content may be stored and indexed automatically. Lack of transparent disclosure undermines informed consent and makes accidental retention of personal or confidential data more likely.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The Kimi API scoring flow sends arbitrary text to an external service but does not warn users that their content may leave the local environment. If users ask the agent to remember sensitive information, that data could be disclosed to a third party during automatic scoring without their awareness.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file structure and retrieval design explicitly include contact information and 'related API keys' in long-term memory, instructing the agent to persist and retrieve sensitive data. In the context of a memory skill, this is especially dangerous because the entire purpose is durable retention and later recall, magnifying the risk of secret leakage, unauthorized access, and secondary disclosure through summaries or searches.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The Silent Agent flow performs content extraction, scoring, file writes, and index updates automatically, yet the documentation does not foreground the privacy and persistence implications. Silent or background writes are especially risky because they can archive data users never intended to retain and make later disclosure through retrieval more likely.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Automatically invoking archival at session end is insufficiently specific because many sessions may contain transient or sensitive content that was never intended for persistence. Without explicit confirmation or content filtering, this behavior can silently store private data and create a larger long-term exposure surface.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Referencing API keys as memory content without an explicit prohibition signals that credential storage is acceptable in this system. That omission is dangerous because users or downstream implementers may persist secrets into searchable markdown files that are then indexed and retrievable by the agent.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly treats 'contacts.md - 相关API密钥' as retrievable memory content, which normalizes storing secrets inside conversational memory files. This is dangerous because memory stores are likely to be broadly readable by the agent and may later be surfaced, indexed, summarized, or exfiltrated during retrieval or archival flows.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The automatic archival pipeline encourages broad capture of conversation content into long-term and short-term memory without clearly restricting sensitive information. Because the process is designed to happen silently and at session boundaries, it increases the likelihood that personal data, confidential business content, or credentials are persisted unintentionally.
- Content