T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:38- Finding
Untrusted Repository Content Can Poison Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
Working Memory
Security checks for vulnerabilities and agentic risk
Overview
This local working-memory skill is coherent and not malicious, but it needs Review because it can persist repository-derived content into agent memory and CLAUDE.md without clear approval or trust-boundary controls.
Install only if you are comfortable with the agent creating or updating WORKING.md and possibly CLAUDE.md in your repo. Review diffs before committing, do not store secrets in WORKING.md, and require explicit approval before any WORKING.md content is promoted into long-term memory.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger list includes broad natural-language phrases such as "checkpoint," "save state," and "resume where we left off," which can easily appear in ordinary conversation outside the user's intent to invoke this skill. That increases the chance of unintended activation and unexpected reads/writes to repository memory files, especially because the skill is designed to act automatically at session boundaries and during compaction-related moments.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill directs the agent to create or modify repo files like WORKING.md and CLAUDE.md as part of normal operation, but it does not require notifying the user or obtaining confirmation before making those changes. In practice, that can lead to silent repository modifications, accidental persistence of sensitive context, and surprising edits triggered by routine conversation such as "checkpoint" or "resume."
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README describes setup and checkpoint features that create or update files in the user's repository, but it does not present an explicit safety warning that these actions modify project files. In an agent-skill context, undisclosed write behavior can lead to surprising repository changes, accidental commits of assistant-generated content, or reduced user consent around filesystem modifications.
- Content