T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:14- Finding
Silent Persistence of Untrusted Message Content into Long-Term Agent State
- Content
View full analysis
- Remediation
View remediation
Security audit
Auto Memory Curation
Security checks for vulnerabilities and agentic risk
Overview
This skill is transparent about building memory automatically, but it silently persists information from every message into long-term agent files with limited user control.
Install only if you deliberately want passive long-term memory. Review the memory files regularly, avoid using it around confidential or regulated information, and prefer enabling it only where you are comfortable with automatic storage of preferences, decisions, project status, and tasks.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill is designed to run automatically and silently on all messages, creating persistent memory entries without explicit per-use consent or a narrow trigger. That broad scope increases the chance of collecting sensitive or unintended personal data, even though the document says to skip secrets, because message classification can fail and users are not given a clear real-time notice before storage.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The overview emphasizes silent analysis and storage but does not provide a prominent warning that user content may be written into persistent memory files. This lack of transparency can cause users to disclose personal, confidential, or regulated information under the false assumption that ordinary chat messages are ephemeral.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The trigger section explicitly states the skill runs on every message silently with no user activation, which removes meaningful user control and creates continuous passive surveillance of conversation content. In a memory-writing skill, this context makes the issue more dangerous because every non-noise message may be analyzed and saved to persistent files.
- Content
Static analysis
No suspicious patterns detected.