T02 · Agent Memory Poisoning
Error
- Location
scripts/log-error.sh:29- Finding
Untrusted Transcript Content Can Poison Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
ACC Error Memory
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly does what it claims, but it processes private transcripts, can send excerpts to configured model CLIs, and stores untrusted error text where future agents may load it as guidance.
Install only after reviewing whether transcript analysis and persistent memory fit your privacy needs. Prefer local-only ACC_MODELS, avoid --with-cron until you understand the cadence, review ACC_STATE.md before loading it into sessions, and fix the update-watermark.sh timestamp interpolation issue before using this in a shared or untrusted workspace.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/haiku-screen.sh:58- Finding
Conversation Excerpts May Be Disclosed to Externally Hosted Model CLIs
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/update-watermark.sh:14- Finding
Arbitrary Python Code Injection Through the Watermark Timestamp Argument
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (23)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description presents this skill as an active error-pattern tracking and mitigation system. The supplied code chunk is instead a simple shell script that checks for a specific JSON file, extracts fields with jq, and writes a Markdown report summarizing existing state. This is materially narrower and different from the declared purpose: it visualizes/syncs already-collected data rather than performing the core tracking, detection, escalation, or learning behaviors described. While the generated Markdown references those concepts textually, the code itself does not implement them.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description is about error pattern tracking and mitigation learning, but the supplied code does not analyze errors, detect corrections, escalate recurring mistakes, or learn mitigations. Its sole function is maintaining a processing watermark file, optionally sourcing the timestamp from pending-errors.json or the current time. This is a materially different primary purpose and accesses specific workspace memory files not implied by the declared description.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The documentation describes sending prompts to CLI-accessible models via
ACC_MODELSbut does not clearly warn that transcript content may leave the local environment and be processed by external providers. In the context of conversation analysis, this is a serious disclosure issue because sensitive user/assistant exchanges could be transmitted without explicit informed consent.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README explicitly describes extracting user/assistant exchanges from transcripts and logging error patterns with context, but provides no warning, consent guidance, retention limits, or privacy safeguards. In an agent skill, transcript content can include sensitive personal, business, or credential-related data, so normalizing silent collection/logging increases the risk of privacy violations and downstream data exposure.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill clearly describes shell execution, environment-variable use, and read/write access to workspace files, but it does not declare any tool scope or permission boundaries. That makes the effective privilege surface implicit and harder to review, increasing the chance that an agent executes it with broader capabilities than users expect.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill persists and analyzes conversation-derived error data across sessions, but the description does not prominently warn users that their interactions are being retained. This creates an informed-consent and privacy risk, especially where transcripts may include secrets, personal data, or sensitive business context.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill is designed to persistently extract and log user-assistant exchanges across sessions, creating a durable store of natural-language interaction data. Even if intended for quality improvement, that retained corpus can expose secrets, personal data, or sensitive context to later processes, other skills, or anyone with filesystem access.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
ACC_MODELSallows arbitrary CLI commands to be supplied and invoked with transcript-derived prompts appended, which creates both command-surface and data-exfiltration risk. Because the command is model-agnostic and not constrained to vetted binaries or local-only inference, sensitive conversation content could be sent to unintended external services or abused by unsafe command wrappers.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The install instructions mention cron setup, but the skill description does not clearly warn that conversation-processing jobs may run automatically after installation. Automatic background analysis increases privacy and operational risk because users may not realize when or how often transcript data is processed.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The preprocessing pipeline explicitly extracts and stores user/assistant exchanges from transcripts in a JSON file, which materially increases the amount of readable conversational data at rest. In this skill’s context, that broad collection is more dangerous because it centralizes content for later analysis and possible onward transmission to model CLIs.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script forwards assistant/user conversation content to external LLM CLI tools during calibration, which expands a local pattern-learning feature into data egress to third-party tooling. Even if intended for better classification, this can expose potentially sensitive conversation content and changes the trust boundary in a way users may not expect.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script builds subprocess commands from the configurable ACC_MODELS environment variable and executes them on sampled conversation data. Although subprocess.run is used without shell=True, this still allows arbitrary executable selection and argument control by whoever can influence the environment, enabling execution of untrusted programs and exfiltration of data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The classification step sends sampled conversation content to external LLM commands without any explicit consent, warning, or confirmation at the point of use. In a memory/error-tracking skill, those exchanges may include sensitive user prompts, making silent transmission a privacy and compliance risk.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script builds the external classifier command from the ACC_MODELS environment variable and executes it for each exchange via subprocess.run. Although shell expansion is not used, this still permits execution of arbitrary binaries and arbitrary outbound integrations chosen by whoever controls the environment, which exceeds the narrow needs of error screening and can be abused for unintended code execution, data exfiltration, or policy bypass.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script sends assistant_text and user_text from conversation exchanges directly to external model CLIs without any consent gate, minimization beyond truncation, or assurance that the backend is local. In this skill context, the data being screened is likely to contain user prompts, assistant responses, and potentially sensitive operational context, so forwarding it to arbitrary configured model backends creates a real privacy and data-handling risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The script extracts user and assistant message text from session transcripts and writes those exchanges to
pending-errors.json. Although the file header describes the output artifact, there is no explicit warning that potentially sensitive transcript content will be copied into a workspace file, which is a privacy-relevant file-write operation.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script explicitly states it syncs state into a markdown file 'for prompt injection', meaning it is preparing agent-consumable content derived from mutable local state and placing it into a form likely to influence future model behavior. In the context of an agent skill, this creates a cross-context prompt-injection channel: if the JSON contents are attacker-controlled or polluted by untrusted inputs, they can steer or manipulate downstream agent decisions under the guise of memory or safety guidance.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The inline comment is a strong indicator that the file's purpose is to create prompt material for agent consumption, not merely track errors. Because the generated markdown includes context text from the JSON state, this increases the risk that untrusted content will be laundered into trusted prompt space, enabling instruction smuggling, behavioral manipulation, or persistence of malicious guidance across runs.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 71% confidence
- Finding
The installation flow sets up scheduled execution three times daily, and later sections document adding a cron job that runs the analysis pipeline automatically. Persistent autonomous scheduling is a distinct operational capability beyond the core semantic purpose described in the manifest, which focuses on detecting, logging, and learning from mistakes.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This code overwrites learned-patterns.json, calibration-state.json, and calibration-errors.json, which affects persisted workspace state. Although the file header mentions one in-place update, there is no clear user-facing warning at the write sites or confirmation around these persistent modifications.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This shell script updates and rewrites the JSON state file, which is a file-modifying operation covered by the missing-warning rule for code files. While the header shows usage, there is no explicit warning, confirmation, or comment disclosing that the command will persistently modify the workspace memory file.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This script writes generated content to ACC_STATE.md using shell redirection, which overwrites or recreates the file. Although the script logs success afterward, it does not disclose beforehand that it will modify a file under the user's workspace, and the file itself contains no comment or prompt warning about that side effect.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This shell script performs a direct write to a persistent workspace file, replacing the watermark contents. Although the script prints a success message afterward, it does not disclose beforehand that it will overwrite state in $WATERMARK_FILE, and the surrounding comments do not explicitly warn about this side effect.
- Content
Static analysis
No suspicious patterns detected.