Learnloop

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:09 AM UTC
• Version: 1.0.0

Overview

The skill is openly a local memory tool, but it writes auto-loaded future-session memories from broad conversation cues without requiring explicit per-item approval.

Install only if you want Claude to write project-local memories that affect future sessions. Before using it, require the agent to ask before saving each memory, avoid storing sensitive personal, business, credential, or private system details, and periodically inspect and delete stale entries under the Claude project memory directory.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:59

Finding

Persistent Agent Memory Poisoning Through Unverified Conversation Triggers

Content

View full analysis

/memory/`: - **Auto-injected** — MEMORY.md is loaded into every new session, no manual recall needed - **Typed** — entries are classified (user / feedback / project / reference) so retrieval is sharp - **Linked** — memories cross-reference via `[[slug]]` for graph-style recall - **Local** — nothing leaves your machine ``` ```markdown | Trigger | Save As | Example | |---------|---------|---------| | User corrects Claude ("No, that's wrong", "Actually...") | `feedback` | "Don't use `git add .` — too broad" | | Command or tool fails unexpectedly | `project` or `feedback` | "`npm test` requires Node 20+ in this repo" | | User shares role, expertise, or preference | `user` | "Senior backend dev, new to React" | | External system referenced | `reference` | "Bugs tracked in Linear project INGEST" | | Knowledge turned out to be outdated | `feedback` | "API moved from v1 to v2 in March" | | Better approach discovered for recurring task | `feedback` | "Use `rg` not `grep` — 10x faster in this monorepo" | | Project deadline or constraint mentioned | `project` | "Mobile freeze starts 2026-03-05" | If you'd otherwise say "I'll keep that in mind for next time" — that's the trigger. You can't keep it in mind. Save it. ``` ```markdown ### Step 1: Detect the Trigger Watch for the seven moments above. The two strongest signals: - **User uses corrective language**: "no", "actually", "wrong", "stop", "don't" - **Validated success on a non-obvious choice**: user accepts an unusual approach without pushback ("yes exactly", "perfect") Save from failure AND success. Saving only correcti ...[truncated 4324 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The top-level description explicitly instructs the agent to capture corrections, errors, and user preferences into future-session memory. Persisting user-provided information by default can create privacy and integrity risks, especially when the stored data later influences outputs without fresh user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README states that the skill persists information into native auto-memory that is automatically injected into future sessions, but it does not prominently warn users that this changes future model behavior across sessions. Persistent cross-session modification is security-relevant because users may disclose data or corrections assuming they are session-local.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs storing role, expertise, preferences, and external-system references as memory, which can include sensitive personal or organizational context and identifiers. Persisting this broad metadata across sessions increases the risk of privacy leakage, profiling, and future-session prompt contamination if the memory becomes stale, overbroad, or attacker-influenced.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation guidance uses a very broad heuristic ('If you'd say "I'll keep that in mind"') that can cause the skill to trigger in many ordinary conversations and persist data without a clear, narrow boundary. In a memory-writing skill, overbroad invocation increases the chance of storing unnecessary, sensitive, or contextually inappropriate information that will affect future sessions.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly directs the agent to persist user role, expertise, preferences, project context, and external references into auto-loaded cross-session memory. This creates a privacy and data-minimization risk because potentially sensitive personal or organizational information may be retained beyond the immediate session and automatically reintroduced later without granular user consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill tells the agent to activate on broad conversational moments, which can cause over-collection of information from ordinary dialogue rather than clearly consented memory events. In this skill's context, that broad trigger is directly coupled to persistent storage, making accidental retention of user preferences, corrections, or project details more likely across sessions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger logic relies on ambiguous words like 'no,' 'actually,' 'wrong,' and positive acceptance phrases, which are common in normal conversation and not reliable indicators of consent to persist memory. Because the skill also instructs saving both corrections and validated successes, these heuristics can silently convert routine exchanges into durable memory entries.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

The skill instructs direct writing to a persistent local memory path under ~/.claude/projects//memory/, establishing durable session persistence that is auto-loaded in future interactions. In context, this is the core mechanism of the skill, so any mistaken, over-broad, or sensitive capture becomes recurring state that can influence later sessions and amplify privacy or prompt-injection style risks.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md

If unsure, ask: *does this guide my future behavior?* (feedback) *or describe a person?* (user) *or a workstream?* (project) *or point elsewhere?* (reference).

### Step 3: Write the Memory File

Path: `~/.claude/projects/<project-id>/memory/<short-kebab-slug>.md`