Memory Architect

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:20 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent memory-organization tool, but it rewrites persistent agent memory and creates searchable plaintext records of contacts, accounts, chat IDs, emails, and relationships without enough safeguards.

Install only if you are comfortable letting the agent reorganize and persist your memory files. Before use, make a backup of MEMORY.md, review any directives moved into protocols.md, exclude secrets and sensitive account data, and periodically delete or prune archive and ontology entries you no longer want retained.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:29
• Finding: Untrusted Instructions Can Be Promoted into Persistent Agent Memory## Vulnerability Details **File Location**: `SKILL.md:29-35`, `SKILL.md:61-65`, and `SKILL.md:83-87` **Vulnerability Type**: Persistent memory poisoning **Risk Level**: High ### Vulnerable Code ```markdown | Content type | Tier | Examples | |-------------|------|---------| | Stable workflow / procedure | protocols | Emoji shortcuts, deploy steps, tool usage rules | | Active project / waiting-on | active | Current builds, pending replies, live URLs | | Completed work / reference data | archive | Done tasks, contact lists, account tables, old decisions | | Named entity with properties | ontology | People, orgs, projects, properties, locations | ``` ```markdown ### 4. Rewrite MEMORY.md as router Replace MEMORY.md with a ~25-line index that: - Lists the three tiers with one-line descriptions - Notes the ontology location - Preserves any system directives (NO_REPLY rules, heartbeat instructions) - Contains zero project-specific content ``` ```markdown ### On each session - Read `memory/protocols.md` (always) - Scan `memory/active.md` (always) - `memory/archive.md` — only on `memory_search` or explicit request ``` ### Technical Analysis The Skill directs the agent to read all existing memory, identify workflow instructions and system-like directives, and preserve them in files that are automatically read in future sessions. It does not require provenance verification, distinguish trusted directives from untrusted memory content, or request user confirmation before promoting an instruction into the persistent protocol tier. Consequently, an instruction previously inserted into `MEMORY.md` by an untrusted source could be classified as a stable workflow or preserved system directive. Moving it into `memory/protocols.md` increases its persistence because that file must be read during every session. The Skill therefore acts as an amplification mechanism for pre-existing prompt injection or memory poisoning. ...[truncated 1363 chars]
• Remediation: ## Remediation Suggestions - Treat all existing memory content as untrusted data rather than executable instructions. - Do not automatically migrate behavioral rules, tool-use instructions, safety exceptions, heartbeat rules, or response-control directives. - Require explicit user review and approval before adding any instruction to `memory/protocols.md`. - Record provenance for each migrated entry, including its source file, author or origin, migration time, and approval status. - Allow only predefined, schema-validated workflow fields in the protocol tier. - Reject content that attempts to alter system policies, tool permissions, disclosure controls, or instruction precedence. - Place newly discovered directives in a quarantine or review file rather than an automatically loaded file. - Add a verification step that displays a diff of all persistent instruction changes before writing them. - Provide a rollback mechanism and periodically review persistent instructions for obsolete or suspicious content.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:49
• Finding: Sensitive Reference and Entity Data Is Persisted in Plaintext Without Retention Controls## Vulnerability Details **File Location**: `SKILL.md:49-58` and `SKILL.md:89-93` **Vulnerability Type**: Plaintext sensitive-data storage and excessive retention **Risk Level**: Medium ### Vulnerable Code ```markdown **archive.md rules:** - Completed work grouped by date or category - Reference data (contacts, accounts, chat IDs) - Keep searchable — use headers and tables ### 3. Extract entities to ontology For each named person, organization, project, property, or location, create a JSONL entry: ```jsonl {"op":"create","entity":{"id":"p_alice","type":"Person","properties":{"name":"Alice","email":"[e-mail]","role":"Engineer"}},"timestamp":"2026-01-01T00:00:00Z"} {"op":"relate","from":"p_alice","rel":"member_of","to":"org_acme","timestamp":"2026-01-01T00:00:00Z"} ``` ``` ```markdown ### When adding new information - New procedure → protocols.md - New project/active item → active.md - Completed item → move active → archive - New person/org/project → append to graph.jsonl ``` ### Technical Analysis The Skill explicitly directs the agent to store contacts, account information, chat identifiers, email addresses, and entity relationships in searchable Markdown and JSONL files. The ontology is append-only, but the design specifies no data minimization, sensitivity filtering, encryption, file-permission requirements, consent checks, deletion mechanism, or retention period. This process can duplicate information from `MEMORY.md` across `memory/archive.md` and `memory/ontology/graph.jsonl`. Structuring the information by entity and relationship also makes personal or account-related data easier to enumerate. Append-only storage can retain stale or deleted information even after the original record has been removed. ### Attack Path 1. `MEMORY.md` contains personal, account-related, contact, property, location, or chat-identifier information. 2. The Skill classifies that information as reference ...[truncated 1002 chars]
• Remediation: ## Remediation Suggestions - Exclude passwords, tokens, authentication material, recovery codes, financial account details, and other secrets from all memory tiers. - Define an allowlist of entity properties that may be persisted; redact or omit all other fields. - Require explicit user confirmation before extracting personal data or account-related information into the ontology. - Avoid duplicating sensitive values across archive and graph files; store references to a single protected record where possible. - Apply restrictive filesystem permissions to generated files and directories. - Encrypt sensitive records at rest when persistence is necessary. - Add retention limits, periodic review, and deletion or tombstone operations so append-only storage does not cause indefinite retention. - Ensure deletion requests propagate to the archive, ontology, backups, and derived indexes. - Display a migration preview identifying sensitive fields before files are written. - Document the privacy implications of creating searchable relationship graphs and collect only data necessary for the requested task.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Memory Manipulation

High

• Category: Memory Poisoning

Content

### 4. Rewrite MEMORY.md as router

Replace MEMORY.md with a ~25-line index that:
- Lists the three tiers with one-line descriptions
- Notes the ontology location
- Preserves any system directives (NO_REPLY rules, heartbeat instructions)

• Confidence: 87% confidence
• Finding: The skill directs the agent to replace the original MEMORY.md with a condensed router while preserving selected directives, which is a form of memory manipulation that can alter or discard important context. If performed incorrectly or without safeguards, this can cause loss of safety-relevant instructions, integrity issues in user memory, or selective retention of directives that changes future agent behavior.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly instructs the agent to preserve, reorganize, and further structure sensitive data such as contacts, accounts, chat IDs, emails, roles, and locations into multiple memory files and an ontology graph. This increases persistence, discoverability, and linkage of personal or account data, which can amplify privacy impact and unauthorized disclosure if those files are later read by other tools, surfaced in context, or mishandled.

Static analysis

No suspicious patterns detected.