T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:502- Finding
Unsanitized External Content Can Poison Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
AI Self-Evolution Engine( AI 自我进化引擎）
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent book-analysis memory tool, but it needs review because it persists model-generated content for future agent use and can send personalized analysis to external services without enough scoping or per-run control.
Review this before installing if your USER.md, HEARTBEAT-reading.md, or generated reading notes contain private work, company, client, or project details. Prefer local-only use, keep Feishu/Notion tokens in environment variables rather than markdown files, approve external sync per run, and avoid auto-loading generated knowledge entries into future sessions until they are reviewed as untrusted reference material.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:502- Finding
Unvalidated Model Identifier Is Interpolated into a Filesystem Path
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is designed to read USER.md and other local state, then incorporate that personal context into generated outputs and optional external records. This creates a natural-language data exfiltration path: sensitive profession, project, challenge, or organizational details can be restated, stored, and potentially synced outside the workspace.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill describes sending analysis outputs to Feishu or Notion but does not clearly warn that generated content, potentially including user-derived context, may leave the local system. That creates a real privacy and data-governance issue because personal or organizational details can be transmitted to third-party services without sufficiently explicit disclosure.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instructions direct the skill to obtain credentials from local content and use them to write records externally, combining secret-handling risk with outbound data transmission. If HEARTBEAT-reading.md contains tokens or user-derived analysis fields, the skill encourages both secret exposure and external leakage of contextual information.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md **Data Persistence**: This skill writes to `thinking-patterns.md` and `reading-history.json` in your workspace. These files persist across sessions. **Optional Integration**: The "auto-load thinking-patterns.md" feature requires manual configuration in your `AGENTS.md`. The skill does NOT automatically modify your agent's behavior without your explicit setup. **Export Tokens**: Environment variables (`FEISHU_APP_TOKEN`, `NOTION_API_KEY`) are entirely optional. The skill works perfectly fine without them (local-only mode).
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The skill persistently writes pattern files, concepts, and reading-history records across sessions. In this context, persistence is intentional functionality, but it is still security-relevant because it accumulates derived user data and AI-generated material that may outlive the session and be reused in later contexts without clear retention controls.
- Content
md - memory/reading-history.json # Load previously analyzed books for deduplication (book titles only) - HEARTBEAT-reading.md # Optional: read schedule config, topic mapping, and Feishu credentials write: - memory/knowledge-base/patterns/*.md # Write individual model files with YAML frontmatter - memory/knowledge-base/concepts.md # Append domain-specific concepts - memory/reading-history.json # Record newly analyzed book + model for future deduplication env:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill advertises dual-value knowledge extraction but does not clearly warn that each run persistently writes AI-generated files and updates reading history. Users may invoke it expecting ephemeral analysis, causing silent accumulation of records and generated content in the workspace without informed consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The top-level description and subsequent templates are written as required Chinese output behavior, and no opt-in or language-selection mechanism is provided. Under the policy, forcing a specific language or locale without user choice is a natural-language policy violation unless clearly justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The workflow instructs automatic creation of directories and files during environment checks without a user-facing notice. Silent mutation of workspace state is risky in agent environments because it can surprise users, create unwanted persistence, and normalize unattended file creation.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill explicitly requires transfer sections and strategic questions to cite concrete user details such as profession, company, or project context. That requirement increases the chance of disclosing sensitive personal or business information in responses, logs, or copied outputs, even when such detail is not necessary for functionality.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
}
text ### Step 4.5. Verify Knowledge Base Write (写入验证，必须执行) **验证逻辑**：
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
}
text ### Step 4.5. Verify Knowledge Base Write (写入验证,必须执行) **验证逻辑**:
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill documentation says credentials may be read from HEARTBEAT-reading.md, while the manifest declares secrets as environment variables. This inconsistency creates a real security risk because operators may place tokens into a readable workspace file, expanding exposure from process environment scope to filesystem scope and making accidental disclosure or downstream propagation more likely.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file mixes headings with extensive Chinese instructions and user utterance examples, implying the skill operates in Chinese by default. There is no indication that users may choose another language or that the Chinese-only behavior is region-specific and justified, which can violate language/locale policy requirements.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The example declares Chinese as the default output format without indicating that language should be selected based on user preference. While not a direct security exploit, forced default language can mislead users, reduce transparency around agent behavior, and increase the chance that important warnings or consent text are not understood.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document explicitly states that output will be written to a local knowledge-base file regardless of mode, but it does not mention asking for user consent, showing the destination clearly at runtime, or providing a way to opt out. Silent or automatic local file modification is risky because it can overwrite, append to, or create persistent data the user did not intend to store.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The routing table and trigger examples prioritize Chinese invocations and a Chinese default path, but do not say that users may interact in other languages or choose output locale. This creates an implicit language policy bias rather than a user-selected language setting.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file contains core operational instructions in Chinese while other sections are in English, effectively imposing a language/locale expectation on the user. The policy allows fixed locale behavior only when it is clearly documented and justified or when users are given a choice, which is not present here.
- Content