T02 · Agent Memory Poisoning
Warning
- Location
setup.md:27- Finding
Persistent Direction-Model Poisoning Through Untrusted Implicit Signals
- Content
View full analysis
- Remediation
View remediation
Security audit
Self-Direction
Security checks for vulnerabilities and agentic risk
Overview
The skill is not overtly malicious, but it persistently builds and shares a behavioral profile so agents can act for the user without enough scoping or control.
Install only if you intentionally want an agent to keep a long-term local profile of your preferences, values, boundaries, reasoning, and decision patterns. Before using it, set clear rules for what may be stored, how to review and delete it, which topics are off limits, and when the agent must ask before acting or sharing direction with sub-agents.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file promotes persistent logging of raw observations used to build a user direction model, but it provides no privacy notice, consent mechanism, retention policy, access controls, or data minimization guidance. Because the content focuses on capturing preferences, reactions, corrections, and inferred patterns, it creates a profiling system that could collect sensitive behavioral data without meaningful transparency or safeguards.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md pattern: "Description of the value pattern" context: work | personal | universal <!-- Example: ### Speed vs Quality confidence: high evidence:
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The instructions to infer and capture implicit signals from choices, reactions, and resource allocation encourage collection beyond what the user explicitly intended to disclose. This is dangerous because inferred preferences, boundaries, and risk tolerance can reveal sensitive personal or business information without meaningful user awareness or validation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs persistent storage of a user's values, goals, boundaries, reasoning, and decision patterns in
~/self-direction/without a clear upfront warning that sensitive profiling data will be written to disk. That creates privacy and security risk because highly revealing behavioral and preference data may be retained locally and later exposed through compromise, backup sync, or unintended access.- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill explicitly directs the agent to progressively collect and retain user reasoning, preferences, and decision patterns, which amounts to structured natural-language logging of sensitive personal and operational data. Even if framed as memory-building, this can accumulate detailed profiles the user did not fully appreciate would be stored long-term.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The sub-agent transmission design encourages sharing accumulated direction data—including values, boundaries, goals, and resource preferences—across additional agents. Propagating profile data increases the attack surface and risk of over-sharing sensitive context to components or agents that may not need the full dataset.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 86% confidence
- Finding
The autonomous operating mode states that the agent may act on a high-confidence model without confirmation, which can convert inferred preferences into effective authority for consequential actions. In a skill specifically built to model and generalize user intent, this raises the risk of unauthorized actions, policy drift, and harmful mistakes being executed without fresh consent.
- Content
md Actively captures direction signals. Asks clarifying questions. Builds model depth. ### Autonomous High-confidence model. Acts on direction without confirmation. Explains reasoning. ### Conservative New relationship or critical domain. Asks more, assumes less. Prioritizes not breaking trust.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md They stated something directly about their preferences, values, or boundaries. - "I always want tests before merging" - "Speed matters more than perfection for MVPs" - "Never spend more than $50 without asking" **Confidence:** Usually high (they said it directly)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md They stated something directly about their preferences, values, or boundaries. - "I always want tests before merging" - "Speed matters more than perfection for MVPs" - "Never spend more than $50 without asking" **Confidence:** Usually high (they said it directly)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md They stated something directly about their preferences, values, or boundaries. - "I always want tests before merging" - "Speed matters more than perfection for MVPs" - "Never spend more than $50 without asking" **Confidence:** Usually high (they said it directly)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs logging on very broad triggers such as any explicit preference, any decision between alternatives, any correction, and any strong reaction. In a 'Self-Direction' skill, this can cause routine conversations to be continuously profiled and stored, expanding collection far beyond what a user would reasonably expect and increasing the chance of sensitive preference inference.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to continuously infer and capture implicit signals such as choices, time allocation, reactions, and rejected suggestions, which amounts to behavioral profiling without transparency to the user. In context, this is more dangerous because the skill's stated goal is to understand the person deeply enough to act as they would, encouraging broad collection of inferred personal preferences beyond what is necessary for a single task.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly directs the agent to create and maintain persistent files in ~/self-direction/ that store a model of the user's preferences, reasoning patterns, boundaries, and sub-agent transmission frames, but it provides no notice, consent step, retention limit, or data-minimization guidance. This creates a real privacy and security risk because sensitive behavioral profiling data may be silently accumulated on disk and later exposed to other tools, agents, or local users.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill explicitly instructs creation of multiple files under the user's home directory (
~/self-direction/...). While the content is not overtly malicious, it directs local filesystem modification without any safety notice, consent step, or scoping guidance, which can lead an autonomous agent to write persistent files on the host unexpectedly.- Content
Static analysis
No suspicious patterns detected.