T09 · Insecure Skill Coding Practices
Error
- Location
scripts/recall.sh:47- Finding
Arbitrary Python Code Execution Through Unquoted Heredoc Interpolation
- Content
View full analysis
- Remediation
View remediation
Security audit
Hippocampus
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed persistent memory system, but it stores and reuses sensitive conversation history with broad background access and several real injection risks.
Install only if you explicitly want an always-on, cross-session memory system. Before enabling cron or adding HIPPOCAMPUS_CORE.md to memory search, review what transcripts it can read, avoid storing secrets or sensitive personal disclosures, and be prepared to inspect and delete memory/index.json and generated dashboard/core files. The script injection and dashboard rendering issues should be fixed before use in a shared, adversarial, or high-sensitivity environment.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T02 · Agent Memory Poisoning
Error
- Location
scripts/encode-pipeline.sh:101- Finding
Persistent Agent Memory Poisoning Through Untrusted Transcript Content
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate-dashboard.sh:470- Finding
Stored HTML and JavaScript Injection in the Generated Brain Dashboard
- Content
View full analysis
> "$OUTPUT_FILE" << HEADER$AGENT_NAME
Brain Dashboard$MOOD_EMOJI $MOOD_LABEL ``` `scripts/generate-dashboard.sh:591-601`: ```bash cat >> "$OUTPUT_FILE" << JSDATA const state = { hippocampus: { installed: $HAS_HIPPOCAMPUS, topMemories: $TOP_MEMORIES }, amygdala: { dimensions: { valence:$VALENCE, arousal:$AROUSAL, connection:$CONNECTION, curiosity:$CURIOSITY, energy:$ENERGY, trust:$TRUST, anticipation:$ANTICIPATION }, recentEmotions: $RECENT_EMOTIONS }, vta: { installed: $HAS_VTA, drive: $DRIVE, seeking: $SEEKING, anticipating: $ANTICIPATING, recentRewards: $RECENT_REWARDS } }; JSDATA ``` `scripts/generate-dashboard.sh:612-618`: ```javascript if (state.hippocampus.installed) { const memEl = document.getElementById('topMemories'); if (state.hippocampus.topMemories?.length) { state.hippocampus.topMemories.forEach(m => { memEl.innerHTML += `${(m.importance*100).toFixed(0)}%${m.summary}`; }); } else memEl.innerHTML = 'No memories yet'; } ``` Additional persisted values are assigned through `innerHTML` at lines 647 and 657-665. ### Technical Analysis The dashboard generator embeds data from `IDENTITY.md`, memory records, emotional-state records, and reward-state records directly into HTML and JavaScript. There are ...[truncated 1996 chars]- Remediation
View remediation
``` Populate it using serialization that escapes `<`, `>`, `&`, Unicode line separators, and closing-script sequences. Parse it with `JSON.parse(document.getElementById("dashboard-state").textContent)`. - Alternatively, generate all dynamic nodes directly with safe DOM APIs. - Add a restrictive Content Security Policy that blocks inline and remote scripts, for example using a nonce-based `script-src`. - Remove the remote Google Fonts import if offline confidentiality is desired, because opening the dashboard currently makes an external request. - Validate schemas and types for emotional and reward state files before rendering. - Add tests containing ``, HTML event handlers, template-literal characters, and markup in every displayed field. ]]>
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/generate-dashboard.sh:30- Finding
Arbitrary Local File Inclusion Through the Configured Avatar Path
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (58)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The design assigns high importance to emotional, vulnerable, trust, and personal preference content and stores it in structured memory files, yet it does not define any sensitive-data handling restrictions. In context, this memory skill is specifically built to persist cross-session personal context, which makes storage of intimate or vulnerable user disclosures especially risky if accessed by other components, leaked, or reused unexpectedly.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Exporting stored memories into a workspace markdown file for later context injection meaningfully changes the exposure surface of captured data. Even if automatic encoding/decay are not implemented, surfacing retained memory into broadly consumed context files can propagate sensitive user information into future sessions and other tools.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Exporting stored memories into a workspace markdown file for later context injection meaningfully changes the exposure surface of captured data. Even if automatic encoding/decay are not implemented, surfacing retained memory into broadly consumed context files can propagate sensitive user information into future sessions and other tools.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
Exporting stored memories into a workspace markdown file for later context injection meaningfully changes the exposure surface of captured data. Even if automatic encoding/decay are not implemented, surfacing retained memory into broadly consumed context files can propagate sensitive user information into future sessions and other tools.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
Exporting stored memories into a workspace markdown file for later context injection meaningfully changes the exposure surface of captured data. Even if automatic encoding/decay are not implemented, surfacing retained memory into broadly consumed context files can propagate sensitive user information into future sessions and other tools.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Exporting stored memories into a workspace markdown file for later context injection meaningfully changes the exposure surface of captured data. Even if automatic encoding/decay are not implemented, surfacing retained memory into broadly consumed context files can propagate sensitive user information into future sessions and other tools.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
Exporting stored memories into a workspace markdown file for later context injection meaningfully changes the exposure surface of captured data. Even if automatic encoding/decay are not implemented, surfacing retained memory into broadly consumed context files can propagate sensitive user information into future sessions and other tools.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Across the file, the prompt directs persistent capture of emotional disclosures, trust signals, conflict, and relationship information without any notice, consent flow, or privacy warning. Retaining this category of sensitive interpersonal data covertly is especially risky because users may reveal it in moments of vulnerability without expecting long-term storage or later behavioral use.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script deliberately strips CJK text and drops messages with low ASCII ratio, creating a language-biased filter that can silently discard or distort valid transcript content. In a persistent memory system, this can cause integrity failures, unfair treatment of multilingual users, and loss of important safety or operational context, which may lead downstream agent behavior to be incomplete or misleading.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The architecture explicitly describes continuous background monitoring of conversations and persistent storage of extracted memories, but provides no user-facing consent, notice, retention, or control model. This is dangerous because it enables silent collection and long-term retention of user data, including potentially sensitive information, without informed user awareness or minimization.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The architecture states that high-importance memories are automatically loaded into future sessions, but does not warn users that prior personal data will be reused later or give them control over that behavior. This creates a privacy and contextual-integrity risk because information shared in one interaction may silently influence later sessions in ways the user does not expect.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The configuration explicitly instructs a background agent to 'run silently' and 'just update the files,' which enables persistent modification of memory/index.json without any user-visible notice, approval, or audit signal. In a memory/persistence skill, silent autonomous writes are especially risky because they can alter long-term agent state, hide tampering, and make prompt-injected or mistaken memory changes difficult to detect.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README explicitly describes background extraction of conversation signals, LLM summarization, and persistent memory formation, but it does not clearly warn users that potentially sensitive conversation content will be collected, transformed, and stored over time. In a memory skill, this creates a real privacy and consent risk because users may not realize their chats are being processed by scheduled jobs and retained beyond the active session.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 89% confidence
- Finding
The skill is designed to persist distilled conversation data across sessions via background encoding and memory storage, which matches session persistence behavior. In this context that persistence is intentional functionality, but it is still security-relevant because cross-session retention of user-derived summaries can expose sensitive information, expand blast radius after compromise, and surprise users if not transparently disclosed and controlled.
- Content
md Your main agent is busy having conversations—it can't constantly stop to decide what to remember. That's what the hippocampus does. It operates as a separate process: 1. **Background encoding**: A cron job extracts signals, scores them, and uses LLM to create concise summaries 2. **Automatic decay**: Unused memories fade over time (daily cron) 3. **Semantic reinforcement**: When similar topics come up again, existing memories strengthen automatically
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill advertises and operationalizes shell execution, file reads/writes, and environment-variable usage, but it does not declare any explicit tool scope or permissions boundary. That creates an authorization and review gap: operators cannot easily assess what access the skill needs before installation, and the skill can process or mutate local workspace data beyond user expectations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The installation flow encourages setting up cron-based background processing, yet it does not clearly warn that these jobs will continue running after install and keep updating memory artifacts over time. Persistent unattended processing increases privacy and integrity risk because data capture continues outside the immediate user action that triggered installation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill clearly promotes persistent memory, whole-history processing, and storage of conversation-derived facts, including sensitive personal context, but it does not provide an upfront warning commensurate with that privacy impact. Users may enable it without realizing that historical and future conversations can be automatically retained and reused.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The '--whole' option and transcript signal extraction encourage broad, indiscriminate retention of complete conversation history rather than narrowly scoped memory capture. That creates a substantial privacy risk because sensitive information that was never intended as durable memory can be extracted, scored, and stored for future use.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Automatically loading high-importance memories at session start increases the chance that previously captured personal data will be resurfaced in unrelated future interactions. In this skill’s context, that amplification is dangerous because the stored material can include preferences, emotional content, and relationship history, making inadvertent disclosure more likely.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly encourages persistence of user facts, emotional or vulnerable content, and relationship or trust history. In an agent memory context, this is highly sensitive profiling data that can be exposed later through recall, session-start loading, dashboards, or context injection, making the surrounding skill context more dangerous rather than less.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the agent to read user message content from a signals file and persist profile-like memories such as preferences, emotions, relationship moments, and personal facts. This creates a privacy and retention risk because it stores potentially sensitive behavioral and personal data without any visible consent, minimization, retention limit, or user-facing warning in the skill instructions.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The skill requires writing a complete persistent memory index including all stored memories and a processing watermark, creating durable cross-session state. In this context, session persistence increases risk because it preserves personal and relational inferences over time, potentially amplifying privacy harm, stale-data effects, and unintended behavioral carryover across future interactions.
- Content
md Set `lastProcessedMessageId` to the last signal ID you processed. Set `lastUpdated` to current ISO timestamp. ### Step 7: Write the complete index.json **IMPORTANT:** Write the ENTIRE updated index.json file with: - Updated `lastProcessedMessageId`
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly instructs background collection and persistent storage of conversation-derived memories, including personal and emotional information, but provides no user notice, consent flow, or visibility controls. This creates a privacy risk because users may disclose sensitive information during ordinary conversation without understanding it is being retained in long-term storage.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instructions explicitly prioritize storing emotional vulnerability, user preferences, relationship details, and trust-related exchanges as long-term memory. This is dangerous because it directs the system to retain highly sensitive personal disclosures that can reveal mental state, interpersonal dynamics, and private behavioral patterns, creating substantial privacy and misuse risk if accessed, leaked, or repurposed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file describes ongoing retention behavior through decay, reinforcement, and archival review, which means user data may persist indefinitely or semi-indefinitely without transparent retention notice. Even with decay, the design encourages durable storage of personal context, increasing privacy exposure and the chance of retaining information longer than users expect.
- Content
Static analysis
Detected: suspicious.prompt_injection_instructions
Prompt-injection style instruction pattern detected.
Warn
- Code
- suspicious.prompt_injection_instructions
- Location
- CONFIG-UPGRADE.md:23