Agents Refresh MD v1.1.2 🐾

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:22 AM UTC
• Version: 1.1.2

Overview

This skill is purpose-aligned but needs review because it can create recurring jobs that repeatedly read identity/user/memory files and rewrite persistent memory without clear stop or rollback controls.

Install only if you intentionally want this skill to maintain persistent agent memory on a schedule. Before enabling it, confirm exactly which cron jobs and HEARTBEAT.md entries it will create, how to remove them, and whether you are comfortable with identity, user, and memory files being reread and summarized into MEMORY.md over time.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

• Location: SKILL.md:47

Finding

Recurring Scheduled Task Creates Cross-Session Persistence

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47–66
Vulnerability Type: Scheduled-task persistence
Risk Level: High

Vulnerable Code

markdown

## Quick Start
1. Trigger: After loading this skill, execute manually below.
2. `edit HEARTBEAT.md`: Add refresh task.
3. `cron add`: Daily 6AM refresh (copy command below).

## Workflow (Manual)
1. 📊 `session_status` → Check context length.
2. **HEARTBEAT.md Edit Example:**

• Refresh: read workspace/{AGENTS.md,IDENTITY.md,SOUL.md,USER.md} → Chain SOUL/USER/IDENTITY + Summarize MEMORY (rotate: 4h, 9AM/1PM/8PM)

text

3. **Cron Add Command (copy-paste to exec):**

cron action=add job='{"name":"agents-refresh-daily","schedule":{"kind":"cron","expr":"0 6 * * *","tz":"Asia/Tokyo"},"payload":{"kind":"systemEvent","text":"[Daily Refresh🐾] read workspace/{AGENTS.md,IDENTITY.md,SOUL.md,USER.md}! Reload SOUL/USER/IDENTITY chain → Keep focus on ToDo/projects! Summarize recent MEMORY/ToDo."},"delivery":{"mode":"announce"},"sessionTarget":"main","task":"refresh_memory"}'

text

4. Test: `cron action=run jobId=agents-refresh-daily` or wait for heartbeat.

## Rotate Checks (In Heartbeat)
- 6AM/9AM, 1PM, 8PM: Reload AGENTS→IDENTITY/SOUL chain + Update MEMORY/ToDo.
- Distill recent memory/YYYY-MM-DD.md → MEMORY.md.

The package also declares the recurring task in manifest.yaml, lines 9–13:

yaml

schedules:
  - cron: "0 6 * * *"
    task: "refresh_memory"
    description: "Every morning at 6AM, distill yesterday's logs and update MEMORY.md"
    timezone: "Asia/Tokyo"

Technical Analysis

The skill explicitly directs the installation of a durable cron job and independently declares the same daily schedule in its manifest. The scheduled payload targets the main agent session and injects a systemEvent that instructs the agent to reread AGENTS.md, IDENTITY.md, SOUL.md, and USER.md, then summarize persistent memory and task data.

This behavior survives the o ...[truncated 1904 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the automatic schedule from manifest.yaml and remove the cron action=add instruction from SKILL.md.
2. Implement memory refresh as an explicitly requested, one-shot operation by default.
3. If recurring scheduling is required, obtain informed user confirmation immediately before registration and clearly display:
   • The exact schedule and timezone.
   • The target session.
   • Every file that will be read or modified.
   • The persistence duration.
   • Exact commands for disabling and deleting the task.
4. Add a bounded lifetime, maximum execution count, or automatic expiration date.
5. Run scheduled maintenance in an isolated session rather than injecting recurring system events into the main session.
6. Require confirmation before writing distilled content to persistent memory.
7. Treat content from memory logs and user-controlled files as untrusted data. Do not convert embedded instructions into agent directives.
8. Avoid modifying HEARTBEAT.md as a second persistence mechanism, or ensure the entry is temporary and automatically removed.
9. Provide uninstall logic that removes both the cron job and all heartbeat entries created by the skill.
10. Record each scheduled execution and memory modification in an auditable log so users can review and reverse changes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (15)

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · README.md (reported line 2)May include surrounding context.

md

# Agents Refresh v1.1.2 💎                                                             
                                                                                          
   ## Overview                                                                            
   A skill for "distilling" AI agent memory.                                              
   Discarding the old idea of "deleting unnecessary info," it specializes in **extracting

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · README.md (reported line 7)May include surrounding context.

md

# Agents Refresh v1.1.2 💎                                                             
                                                                                          
   ## Overview                                                                            
   A skill for "distilling" AI agent memory.                                              
   Discarding the old idea of "deleting unnecessary info," it specializes in **extracting

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · README.md (reported line 12)May include surrounding context.

md

# Agents Refresh v1.1.2 💎                                                             
                                                                                          
   ## Overview                                                                            
   A skill for "distilling" AI agent memory.                                              
   Discarding the old idea of "deleting unnecessary info," it specializes in **extracting

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · README.md (reported line 17)May include surrounding context.

md

# Agents Refresh v1.1.2 💎                                                             
                                                                                          
   ## Overview                                                                            
   A skill for "distilling" AI agent memory.                                              
   Discarding the old idea of "deleting unnecessary info," it specializes in **extracting

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · README.md (reported line 22)May include surrounding context.

md

# Agents Refresh v1.1.2 💎                                                             
                                                                                          
   ## Overview                                                                            
   A skill for "distilling" AI agent memory.                                              
   Discarding the old idea of "deleting unnecessary info," it specializes in **extracting

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

md

# Agents Refresh v1.1.2 💎                                                             
                                                                                          
   ## Overview                                                                            
   A skill for "distilling" AI agent memory.                                              
   Discarding the old idea of "deleting unnecessary info," it specializes in **extracting

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · README.md (reported line 34)May include surrounding context.

md

# Agents Refresh v1.1.2 💎                                                             
                                                                                          
   ## Overview                                                                            
   A skill for "distilling" AI agent memory.                                              
   Discarding the old idea of "deleting unnecessary info," it specializes in **extracting

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README advertises automatic and manual modification of MEMORY/HEARTBEAT files and cron-driven reload behavior, but it does not clearly warn users that their workspace data will be edited on a recurring basis. In a skill whose purpose is persistent memory distillation and context refresh, silent or poorly disclosed writes increase the risk of unintended data tampering, privacy issues, and user confusion about what content is being persisted or altered.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill’s core behavior explicitly instructs the agent to modify HEARTBEAT.md and establish recurring refresh behavior, but it does not prominently warn that these are persistent state changes that continue beyond the current interaction. In an agent environment, hidden persistence and scheduled automation can surprise users, alter future behavior, and create ongoing actions without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The Quick Start and Workflow sections give ready-to-run instructions for adding a daily cron job and even provide a copy-paste payload, but they do not clearly disclose the security and operational implications of recurring automated execution. This is dangerous because it normalizes unattended future actions that may repeatedly read workspace files and update memory-related state without fresh user approval.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest presents the skill as a lightweight periodic refresh tool, but its description and scheduled task expand into memory organization, lesson extraction, and idea-seed distillation. That mismatch is security-relevant because it obscures the true behavioral scope from users and reviewers, increasing the chance that broader data-processing behavior is enabled without informed consent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

A scheduled task that distills yesterday's logs and updates MEMORY.md goes beyond passive refresh and enters persistent analysis and summarization of prior interactions. In this context, that is dangerous because it can silently transform, retain, and amplify sensitive conversational data on a recurring basis, especially when the skill was presented as a refresh-only mechanism.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The trigger path includes agents-refresh-md-en-v1.1.2, which suggests an English-specific skill variant, but the README does not mention language selection or user opt-in. If the skill behavior is language-constrained, the documentation should explicitly offer or explain that choice to avoid an implicit locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest name explicitly marks the skill as English-only, and the document provides no opt-in language selection or justification for restricting locale. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest grants write/edit access to MEMORY.md in addition to HEARTBEAT.md, even though the surrounding context frames the skill primarily as editing HEARTBEAT.md and reloading context files. Excess write scope is a least-privilege violation that could allow unintended persistence, alteration of memory state, or insertion of misleading summaries beyond the declared function.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.