Security audit

Skill Experience Layer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a learning-memory helper, but it asks agents to automatically write and reuse persistent guidance while giving conflicting limits about long-term memory changes.

Review this skill before installing if you do not want automatic changes to agent memory. It should be used only with clear approval controls for writing corrections, updating best practices, invoking capability-evolver, and proposing any MEMORY.md changes as reviewed diffs rather than applying them automatically.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:38
Finding: Untrusted experience records can persistently influence future agent behavior<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 38-56 **Vulnerability Type**: Persistent memory poisoning through automatically reused experience records **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ### 1. For every skill you use When you install a new skill: - Create `memory/experiences/{skill-name}.json` - Define `commonMistakes[]` and `bestPractices[]` - *Before every invocation*, read it and remind yourself what to avoid ### 2. When you make a mistake 1. Stop immediately, don't keep retrying 2. Record the mistake in `self-improving/corrections.md` 3. Update the skill's experience JSON: - Add new entry to `experiences[]` with context, lesson, prevention - Update `commonMistakes[]` if it's a new pattern - Increment `failureCount` 4. If the *same mistake repeats 2+ times*, trigger `capability-evolver` to automatically improve the experience and best practices 5. Retry after updating ### 3. Regular maintenance - **Daily**: End-of-day review mistakes, update experiences - **Weekly**: Promote key lessons to long-term memory in MEMORY.md - **Automatic**: capability-evolver can continuously improve stale experiences ``` ### Technical Analysis The Skill directs the agent to persist task-derived context, lessons, prevention instructions, common mistakes, and best practices. It then instructs the agent to read these records before every subsequent skill invocation and eventually promote selected content into long-term memory. No validation, provenance tracking, trust separation, schema-level content restriction, or human review requirement is defined before generated content becomes persistent guidance. Consequently, adversarial material encountered during a task could be summarized as an imperative lesson or best practice and later treated as trusted behavioral instruction. The integration with `capability-evolver` increases the exposure because repeated events can trigger automatic modification of stored g ...[truncated 1639 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat all generated experience content as untrusted data rather than agent instructions. 2. Enforce a strict schema with allowlisted enumerations and bounded descriptive fields. 3. Reject or neutralize imperative language, tool commands, policy overrides, URLs, and embedded prompts in persisted fields. 4. Record provenance for every entry, including the originating task, author, timestamp, and review state. 5. Keep stored records outside the agent's privileged instruction context; summarize them through a trusted parser before use. 6. Require explicit human approval before adding content to `bestPractices[]`, invoking `capability-evolver`, or promoting any record to `MEMORY.md`. 7. Scope each experience record to the originating skill and prevent automatic cross-skill promotion. 8. Provide deletion, rollback, expiration, and audit-log mechanisms for all persistent entries. 9. Clearly distinguish factual telemetry from behavioral rules so task-controlled context cannot become a durable instruction. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:43
Finding: Documented write behavior contradicts the declared safety boundary<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 43-56 and 108-111 **Vulnerability Type**: Inconsistent filesystem write restrictions and unenforced safety controls **Risk Level**: Medium ### Vulnerable Code Snippets The workflow requires writes outside the dedicated experience directory and directs promotion into `MEMORY.md`: ```markdown ### 2. When you make a mistake 1. Stop immediately, don't keep retrying 2. Record the mistake in `self-improving/corrections.md` 3. Update the skill's experience JSON: - Add new entry to `experiences[]` with context, lesson, prevention - Update `commonMistakes[]` if it's a new pattern - Increment `failureCount` 4. If the *same mistake repeats 2+ times*, trigger `capability-evolver` to automatically improve the experience and best practices 5. Retry after updating ### 3. Regular maintenance - **Daily**: End-of-day review mistakes, update experiences - **Weekly**: Promote key lessons to long-term memory in MEMORY.md - **Automatic**: capability-evolver can continuously improve stale experiences ``` The safety section makes conflicting claims: ```markdown ## Safety Boundaries - ✅ Only modifies experience files in `memory/experiences/` and skill-owned files - ✅ Never touches core root files (`MEMORY.md`, `SOUL.md`, `IDENTITY.md`, `USER.md`, `.env`) — reads but does not write - ✅ Never accesses sensitive directories (`~/.ssh`, `~/.aws`, `/etc`) - ✅ All automatic changes are backed up before applying, can roll back ``` ### Technical Analysis The operational workflow requires writing to `self-improving/corrections.md` and promoting lessons into `MEMORY.md`. The safety section simultaneously states that modifications are limited to experience or skill-owned files and that `MEMORY.md` is never written. These contradictory instructions make the effective security boundary ambiguous. The Skill also does not define canonical path validation, symlink handling, an enforceable allowlist, backup imple ...[truncated 1852 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Reconcile the workflow and safety section so they define one unambiguous write policy. 2. Remove automatic promotion to `MEMORY.md`, or require explicit, informed human approval for each proposed change. 3. If `self-improving/corrections.md` must be modified, declare it explicitly and explain why that access is necessary. 4. Restrict automatic writes to a dedicated canonical directory such as `memory/experiences/`. 5. Resolve and validate canonical paths before every write; reject absolute paths, traversal components, and symlink escapes. 6. Implement the claimed backup and rollback behavior rather than documenting it only as an assurance. 7. Use atomic writes, restrictive file permissions, version history, and an immutable audit log. 8. Make shared memory files read-only by default and expose reviewed changes as proposals or diffs. 9. Add tests that verify no workflow can write to `MEMORY.md`, `.env`, identity files, credential directories, or paths outside the allowlisted storage root without approval. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The manifest's read_when conditions are broad and operationally common, such as setting up a new agent, avoiding mistakes, or integrating memory systems. This can cause the skill to activate in many normal workflows, increasing the chance that its self-modification and memory-writing behavior is invoked without sufficiently specific user intent or review. In context, the skill is not overtly malicious, but broad triggering expands exposure and can amplify mistakes across an agent's memory layer.

Natural-Language Policy Violations

Low

Confidence: 78% confidence
Finding: The heading presents the skill name in English and Chinese (`技能经验分层机制`) without indicating whether multilingual output is optional or user-selected. This can conflict with a language/locale policy if the organization expects the user's preferred language unless explicitly opted into another language.

Static analysis

No suspicious patterns detected.