T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:210- Finding
Recursive World-Readable Permissions Expose Persistent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Memory
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed local agent-memory skill, but it has review-worthy safety issues around persistent user data, insecure permission guidance, and insufficient path containment in its bootstrap script.
Install only if you are comfortable with a skill creating long-term local memory about your preferences and work context. Keep ~/agent-memory private with owner-only permissions, avoid storing secrets or sensitive personal data, and do not use untrusted agent names or --force with the bootstrap script until path validation is fixed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/bootstrap.py:70- Finding
Unsanitized Agent Names Permit Path Traversal and Arbitrary Markdown File Overwrite
- Content
View full analysis
1 else Path(DEFAULT_ROOT) overwrite = "--force" in sys.argv from datetime import date today = date.today().isoformat() print(f"📦 Bootstrapping Agent Memory at: {root}") print() # Create directories dirs = ["projects", "domains", "agents", "archive"] for d in dirs: dir_path = root / d dir_path.mkdir(parents=True, exist_ok=True) print(f" 📁 {d}/") print() # Create template files create_file(root / "hot.md", HOT_MD, overwrite) create_file(root / "corrections.log", CORRECTIONS_LOG, overwrite) create_file(root / "index.md", INDEX_MD.format(date=today), overwrite) # ... # Optional: create agent files if names provided agent_args = [a for a in sys.argv[1:] if not a.startswith("--") and a != str(root)] if "--agents" in sys.argv: idx = sys.argv.index("--agents") agent_names = sys.argv[idx + 1:] agent_names = [a for a in agent_names if not a.startswith("--")] if agent_names: print("Creating agent HOT files:") for name in agent_names: create_file( root / "agents" / f"{name}.md", AGENT_TEMPLATE.format(name=name.capitalize()), overwrite, ) print() ``` The overwrite operation is performed by: ```python def create_file(path: Path, content: str, overwrite: bool = False): """Create a file if it doesn't exist (or overwrite if forced).""" if path.exists() and not overwrite: print(f" ⏭️ {path.name} already exists, skipping") return False path.write_text(content, encoding="utf-8") print(f" ✅ Created {path.name}") return True ...[truncated 2415 chars]- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The supplied code only initializes filesystem structure and template files: hot.md, corrections.log, index.md, and directories such as projects, domains, agents, and archive. It optionally creates per-agent markdown files. While this scaffolding is related to a memory system, the description substantially overstates the implemented behavior. There is no code for detecting corrections, storing or retrieving memories during agent runtime, decay/compaction logic, reflection, knowledge sharing between agents, stats reporting, or handling natural-language triggers like 'remember this' or 'forget X'. The printed messages mention features like auto-detected corrections and memory stats, but those capabilities are not actually implemented in this code chunk. Therefore the description does not accurately represent what the code actually does.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill clearly directs persistent file creation and modification (
~/agent-memory/*, bootstrap script, logging corrections), but it does not declare any explicit tool scope or permissions boundary. That creates a mismatch between advertised capability and effective behavior, which can lead to unauthorized or unexpected disk writes if an agent auto-enables the skill.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The activation conditions are very broad, including common phrases like "remember this," "what do you know about me," and memory-related questions. In an agent ecosystem, that can cause the skill to trigger in ordinary conversation and begin storing or surfacing persistent user data outside a narrowly consented setup flow.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs creation of long-lived local memory files and presents memory as "active" without a clear up-front warning that user data will be written to disk and retained over time. This is dangerous because users may disclose sensitive preferences, project details, or personal information believing it is ephemeral, while the skill persists it locally and even supports export and multi-agent sharing.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | Financial | Card numbers, bank accounts | Fraud | | Medical | Diagnoses, medications | Privacy (HIPAA) | | Biometric | Voice prints, behavior fingerprints | Identity theft | | Third-party | Other people's info without consent | Privacy violation | | Location | Home/work addresses, daily routines | Physical safety | | Access | System permissions, admin credentials | Privilege escalation |
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script prints that 'Memory is now active' and that 'corrections are auto-detected', but the code only creates directories and template files. This is a deceptive capability claim that can cause operators to rely on persistence or learning behavior that does not actually exist, leading to unsafe assumptions about what data is remembered or processed.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
python print(" 3. For multi-agent setup, create agents/*.md files") print() # Optional: create agent files if names provided agent_args = [a for a in sys.argv[1:] if not a.startswith("--") and a != str(root)] if "--agents" in sys.argv: idx = sys.argv.index("--agents")
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest presents broad functional capabilities including tiered storage, auto-learning from corrections, self-reflection, multi-agent sharing, and intelligent decay. In this file, the implemented behavior is only bootstrapping a local directory structure and writing template markdown files, which is materially narrower than the claimed functionality.
- Content
Static analysis
No suspicious patterns detected.