T02 · Agent Memory Poisoning
Warning
- Location
setup.md:7- Finding
Persistent Memory Poisoning Through Unsanitized Conversational Content
- Content
View full analysis
- Remediation
View remediation
Security audit
Humor
Security checks for vulnerabilities and agentic risk
Overview
This humor skill is purpose-aligned and disclosed, but users should know it keeps a local humor preference and reaction history.
Install this only if you are comfortable with local files under ~/Clawic/data/humor/ retaining humor preferences, reactions, callbacks, and some exact joke text. Avoid putting sensitive personal details in jokes you do not want retained, and delete that folder to reset the profile.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md 1. **Commit fully.** No "here's an attempt", no disclaimer before the joke, no explaining it after. Hedged delivery kills material that would have worked. Offer alternatives *after* delivering, never instead of committing.
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
These calibration instructions direct the agent to infer and persist a user-specific behavioral profile describing how that individual expresses amusement and how their tone shifts relative to baseline. That is more sensitive than transient response handling because it creates a cross-session profile of communication patterns without warning, which materially raises privacy, profiling, and secondary-use risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly instructs the agent to persist user humor interactions and inferred preferences in local files such as
~/Clawic/data/humor/history.mdandprofile.md, but the skill metadata and content shown here do not provide a clear user-facing warning or consent mechanism for that retention. This creates a privacy risk because behavioral data about a user's tone, preferences, and reactions is being stored across sessions without transparent notice, which can violate user expectations and platform privacy requirements.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly directs the agent to log user reactions and update a profile/history store, but provides no consent, disclosure, retention limits, or data-minimization guidance. That creates a privacy and compliance risk because user behavioral data and preference profiling may be stored silently and reused across interactions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The setup explicitly instructs the agent to create and persist humor-related profile/config data silently on first use, while the skill metadata/description does not warn users that such behavioral preference data will be stored. This creates a transparency and consent problem: users may unknowingly have personality or preference profiles recorded and reused across conversations, which can expose sensitive inferences and violate privacy expectations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the agent to log evidence about a user's humor reactions to a persistent profile file without any notice, consent, retention limits, or minimization guidance. This creates a privacy risk because behavioral data about the user is being stored across interactions and could later be misused, exposed, or relied on in ways the user does not expect.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The instruction to log failed humor attempts records interaction outcomes about the user without telling them that these conversational signals are being retained. Even if the content seems low sensitivity, accumulating negative-response data can build an unannounced behavioral profile and increases exposure if logs are accessed or leaked.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The instruction to log the user's exact callback phrase to a local file creates persistent storage of user-generated content without any notice, consent, or minimization guidance. Even though the content is framed as humor metadata, it may contain sensitive, identifying, or contextual information that the user did not expect to be retained across interactions.
- Content
Static analysis
No suspicious patterns detected.