Agents Refresh MD v1.1.2 🐾

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:22 AM UTC
• Version: 1.1.2

Overview

This skill is purpose-aligned but needs review because it can create recurring jobs that repeatedly read identity/user/memory files and rewrite persistent memory without clear stop or rollback controls.

Install only if you intentionally want this skill to maintain persistent agent memory on a schedule. Before enabling it, confirm exactly which cron jobs and HEARTBEAT.md entries it will create, how to remove them, and whether you are comfortable with identity, user, and memory files being reread and summarized into MEMORY.md over time.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

• Location: SKILL.md:47
• Finding: Recurring Scheduled Task Creates Cross-Session Persistence## Vulnerability Details **File Location**: `SKILL.md`, lines 47–66 **Vulnerability Type**: Scheduled-task persistence **Risk Level**: High ### Vulnerable Code ```markdown ## Quick Start 1. Trigger: After loading this skill, execute manually below. 2. `edit HEARTBEAT.md`: Add refresh task. 3. `cron add`: Daily 6AM refresh (copy command below). ## Workflow (Manual) 1. 📊 `session_status` → Check context length. 2. **HEARTBEAT.md Edit Example:** ``` - [ ] Refresh: read workspace/{AGENTS.md,IDENTITY.md,SOUL.md,USER.md} → Chain SOUL/USER/IDENTITY + Summarize MEMORY (rotate: 4h, 9AM/1PM/8PM) ``` 3. **Cron Add Command (copy-paste to exec):** ``` cron action=add job='{"name":"agents-refresh-daily","schedule":{"kind":"cron","expr":"0 6 * * *","tz":"Asia/Tokyo"},"payload":{"kind":"systemEvent","text":"[Daily Refresh🐾] read workspace/{AGENTS.md,IDENTITY.md,SOUL.md,USER.md}! Reload SOUL/USER/IDENTITY chain → Keep focus on ToDo/projects! Summarize recent MEMORY/ToDo."},"delivery":{"mode":"announce"},"sessionTarget":"main","task":"refresh_memory"}' ``` 4. Test: `cron action=run jobId=agents-refresh-daily` or wait for heartbeat. ## Rotate Checks (In Heartbeat) - 6AM/9AM, 1PM, 8PM: Reload AGENTS→IDENTITY/SOUL chain + Update MEMORY/ToDo. - Distill recent memory/YYYY-MM-DD.md → MEMORY.md. ``` The package also declares the recurring task in `manifest.yaml`, lines 9–13: ```yaml schedules: - cron: "0 6 * * *" task: "refresh_memory" description: "Every morning at 6AM, distill yesterday's logs and update MEMORY.md" timezone: "Asia/Tokyo" ``` ### Technical Analysis The skill explicitly directs the installation of a durable cron job and independently declares the same daily schedule in its manifest. The scheduled payload targets the `main` agent session and injects a `systemEvent` that instructs the agent to reread `AGENTS.md`, `IDENTITY.md`, `SOUL.md`, and `USER.md`, then summarize persistent memory and task data. This behavior survives the o ...[truncated 1904 chars]
• Remediation: ## Remediation Suggestions 1. Remove the automatic schedule from `manifest.yaml` and remove the `cron action=add` instruction from `SKILL.md`. 2. Implement memory refresh as an explicitly requested, one-shot operation by default. 3. If recurring scheduling is required, obtain informed user confirmation immediately before registration and clearly display: - The exact schedule and timezone. - The target session. - Every file that will be read or modified. - The persistence duration. - Exact commands for disabling and deleting the task. 4. Add a bounded lifetime, maximum execution count, or automatic expiration date. 5. Run scheduled maintenance in an isolated session rather than injecting recurring system events into the main session. 6. Require confirmation before writing distilled content to persistent memory. 7. Treat content from memory logs and user-controlled files as untrusted data. Do not convert embedded instructions into agent directives. 8. Avoid modifying `HEARTBEAT.md` as a second persistence mechanism, or ensure the entry is temporary and automatically removed. 9. Provide uninstall logic that removes both the cron job and all heartbeat entries created by the skill. 10. Record each scheduled execution and memory modification in an auditable log so users can review and reverse changes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (15)

Whitespace Padding

Medium

• Category: Prompt Injection

Content

# Agents Refresh v1.1.2 💎                                                             
                                                                                          
   ## Overview                                                                            
   A skill for "distilling" AI agent memory.                                              
   Discarding the old idea of "deleting unnecessary info," it specializes in **extracting

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

# Agents Refresh v1.1.2 💎                                                             
                                                                                          
   ## Overview                                                                            
   A skill for "distilling" AI agent memory.                                              
   Discarding the old idea of "deleting unnecessary info," it specializes in **extracting

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

# Agents Refresh v1.1.2 💎                                                             
                                                                                          
   ## Overview                                                                            
   A skill for "distilling" AI agent memory.                                              
   Discarding the old idea of "deleting unnecessary info," it specializes in **extracting

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

# Agents Refresh v1.1.2 💎                                                             
                                                                                          
   ## Overview                                                                            
   A skill for "distilling" AI agent memory.                                              
   Discarding the old idea of "deleting unnecessary info," it specializes in **extracting

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

# Agents Refresh v1.1.2 💎                                                             
                                                                                          
   ## Overview                                                                            
   A skill for "distilling" AI agent memory.                                              
   Discarding the old idea of "deleting unnecessary info," it specializes in **extracting

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

# Agents Refresh v1.1.2 💎                                                             
                                                                                          
   ## Overview                                                                            
   A skill for "distilling" AI agent memory.                                              
   Discarding the old idea of "deleting unnecessary info," it specializes in **extracting

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

# Agents Refresh v1.1.2 💎                                                             
                                                                                          
   ## Overview                                                                            
   A skill for "distilling" AI agent memory.                                              
   Discarding the old idea of "deleting unnecessary info," it specializes in **extracting

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The README advertises automatic and manual modification of MEMORY/HEARTBEAT files and cron-driven reload behavior, but it does not clearly warn users that their workspace data will be edited on a recurring basis. In a skill whose purpose is persistent memory distillation and context refresh, silent or poorly disclosed writes increase the risk of unintended data tampering, privacy issues, and user confusion about what content is being persisted or altered.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill’s core behavior explicitly instructs the agent to modify HEARTBEAT.md and establish recurring refresh behavior, but it does not prominently warn that these are persistent state changes that continue beyond the current interaction. In an agent environment, hidden persistence and scheduled automation can surprise users, alter future behavior, and create ongoing actions without informed consent.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The Quick Start and Workflow sections give ready-to-run instructions for adding a daily cron job and even provide a copy-paste payload, but they do not clearly disclose the security and operational implications of recurring automated execution. This is dangerous because it normalizes unattended future actions that may repeatedly read workspace files and update memory-related state without fresh user approval.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The manifest presents the skill as a lightweight periodic refresh tool, but its description and scheduled task expand into memory organization, lesson extraction, and idea-seed distillation. That mismatch is security-relevant because it obscures the true behavioral scope from users and reviewers, increasing the chance that broader data-processing behavior is enabled without informed consent.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: A scheduled task that distills yesterday's logs and updates MEMORY.md goes beyond passive refresh and enters persistent analysis and summarization of prior interactions. In this context, that is dangerous because it can silently transform, retain, and amplify sensitive conversational data on a recurring basis, especially when the skill was presented as a refresh-only mechanism.

Natural-Language Policy Violations

Low

• Confidence: 72% confidence
• Finding: The trigger path includes `agents-refresh-md-en-v1.1.2`, which suggests an English-specific skill variant, but the README does not mention language selection or user opt-in. If the skill behavior is language-constrained, the documentation should explicitly offer or explain that choice to avoid an implicit locale restriction.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: The manifest name explicitly marks the skill as English-only, and the document provides no opt-in language selection or justification for restricting locale. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation.

Scope Creep

Low

• Confidence: 88% confidence
• Finding: The manifest grants write/edit access to MEMORY.md in addition to HEARTBEAT.md, even though the surrounding context frames the skill primarily as editing HEARTBEAT.md and reloading context files. Excess write scope is a least-privilege violation that could allow unintended persistence, alteration of memory state, or insertion of misleading summaries beyond the declared function.

Static analysis

No suspicious patterns detected.