Loop Engineering

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:58 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent loop-management helper, but it requires persistent cross-task memory and detailed trace logging without enough user control or redaction safeguards.

Install only if you want this skill to create and reuse cross-task workflow memory. Avoid using it in shared workspaces or on tasks involving credentials, private customer data, proprietary code, or regulated information unless you add clear redaction, review, deletion, and per-project isolation controls.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:381

Finding

Persistent Cross-Session Experience Store Enables Agent Memory Poisoning

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 381-394 and 734-736
Vulnerability Type: Persistent ingestion and reuse of task-derived agent instructions
Risk Level: High

Vulnerable Instructions

The following is a faithful English rendering of the relevant instructions:

text

- The experience bank is stored in YAML format at
  `/workspace/.agent-experience/experience-bank.yaml`.
- At the end of each task, append newly distilled principles to the
  experience bank.

5. Application injection: Inject matching principles into Plan and Repair
   strategies.

- Trace recording is mandatory: Generate a complete `loop_trace` after every
  loop, including failed iterations.
- Experience distillation is mandatory: After every 3–5 similar tasks,
  perform offline distillation and store successful and failed patterns as
  principles.
- Principle application is mandatory: At the beginning of a new task,
  retrieve relevant principles from the experience bank and inject them into
  Plan and Repair strategies.

Technical Analysis

The skill creates a persistent feedback channel between attacker-influenced task content and future agent behavior:

1. Task execution produces traces containing goals, actions, observations, errors, and repair strategies.
2. The skill requires those traces to be distilled into reusable principles.
3. The resulting principles are appended to a persistent YAML file.
4. Future sessions retrieve those principles and inject them into planning and repair decisions.

No trust-boundary separation, provenance validation, instruction sanitization, cryptographic integrity verification, per-user isolation, or mandatory human review is specified before a principle becomes persistent behavioral guidance.

Consequently, attacker-controlled task descriptions, tool output, documents, or failure messages can potentially be converted into trusted-looking principles. Persis ...[truncated 1853 chars]

Remediation

View remediation

Remediation Suggestions

1. Disable cross-session persistence by default and require explicit, informed user consent before creating or updating an experience bank.
2. Isolate experience stores by user, tenant, project, and trust domain. Do not use one shared workspace-level memory file.
3. Treat task text, repository content, retrieved documents, tool output, and model-generated conclusions as untrusted data.
4. Permit only a strict structured schema for principles. Reject shell commands, URLs, credentials, executable fragments, role-changing instructions, and directives that modify safety constraints.
5. Require human approval before promoting a task-derived pattern into persistent memory.
6. Record provenance for every principle, including source task, source fields, author, creation time, validation evidence, and trust level.
7. Do not automatically inject stored text as instructions. Present principles as untrusted contextual suggestions and revalidate them against current policies.
8. Apply restrictive filesystem permissions, integrity checks, version history, expiration dates, and rollback support to the experience bank.
9. Provide users with inspection, deletion, and complete memory-reset controls.
10. Evaluate retrieved principles against current safety policies and task constraints before they can affect Plan or Repair behavior.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:99

Finding

Mandatory Raw Input and Output Logging Lacks Sensitive-Data Redaction

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 99-100 and 734
Vulnerability Type: Excessive collection and retention of potentially sensitive execution data
Risk Level: Medium

Vulnerable Instructions

The following is a faithful English rendering of the relevant instructions:

text

The following must be recorded:
- The input parameters; important parameters must be written explicitly.
- The raw output, or a summary of its first 50 lines if the output is long.

- Trace recording is mandatory: Every loop must generate a complete
  `loop_trace` after completion, and failed iterations must not be omitted.

Technical Analysis

The skill requires explicit recording of input parameters, raw output, and complete execution traces, but defines no redaction or data-minimization requirements.

Tool parameters and outputs commonly contain sensitive material such as:

• API keys, access tokens, session identifiers, and authorization headers.
• Environment variables and connection strings.
• Personal or customer data.
• Private source code and file contents.
• Internal hostnames, filesystem paths, and infrastructure details.
• Error output that echoes submitted credentials or request payloads.

Limiting long output to its first 50 lines does not provide confidentiality because secrets frequently appear near the beginning of command output or responses. The complete-trace requirement also increases retention and exposure by preserving failed attempts that may contain diagnostic data or mistakenly supplied credentials.

Although the reviewed skill does not specify network exfiltration, copied secrets can remain in the conversation context, generated traces, or downstream experience artifacts and become accessible to later users or processes with access to those locations.

Attack Path

1. A user or automated tool supplies a parameter containing a token, credential, personal record, or co ...[truncated 1285 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace mandatory raw logging with data-minimized summaries.
2. Never record secrets, passwords, private keys, tokens, cookies, authorization headers, connection strings, or complete environment-variable values.
3. Add automatic redaction for common secret formats and sensitive field names before any value enters agent context, logs, traces, or persistent memory.
4. Maintain allowlists of parameters and output fields that may be recorded rather than relying only on blocklists.
5. Make trace persistence opt-in and define a short, enforceable retention period.
6. Encrypt retained traces and restrict access using least-privilege filesystem permissions.
7. Separate diagnostic metadata from task content and store only error types, status codes, and sanitized summaries by default.
8. Prevent trace data from being distilled into persistent principles unless it has passed a separate sensitive-data scan.
9. Provide secure deletion and trace-review controls.
10. Add tests with representative credentials and personal data to verify that redaction occurs before logging or persistence.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

L003 整体描述仅以中文呈现，文件全文也默认以中文指令和输出结构说明技能行为，未说明是否支持用户选择其他语言。根据语言/locale 政策，若技能实际强制特定语言而无用户选择或合理限定，可能构成策略违规。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

L023 使用“任何涉及『执行 → 验证 → 修正』循环的任务”作为触发条件，范围非常宽，几乎可覆盖大量日常请求。虽然文档给出少量不触发示例，但没有进一步限定边界或提供更多排除条件，容易与其他普通多步骤任务重叠。

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill mandates persistent recording of detailed task traces, including execution history and contextual details, into reusable long-term memory. In an agent setting, this can retain sensitive user data, credentials in command traces, proprietary code context, or operational metadata beyond the original task boundary, increasing exposure and cross-task leakage risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trace schema explicitly stores goal, plan, execution log, final result, and environment/context, which can semantically encode sensitive user instructions, internal filenames, infrastructure details, or confidential business data. Because the schema is comprehensive and required, it creates a systematic channel for over-collection and durable retention of sensitive information.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The experience bank is explicitly defined as on-disk long-term memory that is appended after tasks, creating persistent accumulation of prior task information across sessions. This materially raises the risk of unauthorized reuse, unintended disclosure, and privacy boundary violations, especially if multiple users, projects, or trust domains share the same workspace.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Requiring new tasks to retrieve and apply prior stored principles creates a cross-task propagation path where information distilled from one user's context can influence or reveal details in another task. Even if summarized as 'principles,' improperly sanitized experience can leak sensitive patterns, internal architecture, customer context, or prior prompts across isolation boundaries.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

L461-L465 将“涉及≥3个技术栈”“需要多个专家协作”等表述作为自动升级条件，但这些描述仍较抽象，且缺少明确的优先级、排除条件或反例。这样的触发规则可能覆盖许多并不真正需要多代理编排的常见复杂任务。

Content

No source excerpt is available for this finding.