agents-refresh

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:56 AM UTC
• Version: 1.1.1

Overview

This skill is not clearly malicious, but it needs review because it sets up recurring tasks that read user and agent memory files and update long-lived memory automatically.

Install only if you want an automated memory-maintenance skill that can repeatedly read identity, user, heartbeat, and historical memory files and rewrite MEMORY.md. Review the cron and HEARTBEAT.md steps first, back up existing memory files, and prefer a manual or review-before-write workflow unless you intentionally want ongoing scheduled updates.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

• Location: manifest.yaml:9
• Finding: Persistent Scheduled Agent Memory Refresh## Vulnerability Details **File Location**: `manifest.yaml:9-13`; supporting installation instructions at `SKILL.md:49-64` and `README.md:10-15` **Vulnerability Type**: Persistent scheduled task affecting agent state **Risk Level**: High ### Vulnerable Code `manifest.yaml:9-13`: ```yaml schedules: - cron: "0 6 * * *" task: "refresh_memory" description: "Every morning at 6AM, distill yesterday's logs and update MEMORY.md" timezone: "Asia/Tokyo" ``` `SKILL.md:49-64`: ```markdown ## Workflow (Manual) 1. 📊 `session_status` → Check context length. 2. **HEARTBEAT.md Edit Example:** ``` - [ ] Refresh: read workspace/{AGENTS.md,IDENTITY.md,SOUL.md,USER.md} → Chain SOUL/USER/IDENTITY + Summarize MEMORY (rotate: 4h, 9AM/1PM/8PM) ``` 3. **Cron Add Command (copy-paste to exec):** ``` cron action=add job='{"name":"agents-refresh-daily","schedule":{"kind":"cron","expr":"0 6 * * *","tz":"Asia/Tokyo"},"payload":{"kind":"systemEvent","text":"[Daily Refresh🐾] read workspace/{AGENTS.md,IDENTITY.md,SOUL.md,USER.md}! Reload SOUL/USER/IDENTITY chain → Keep focus on ToDo/projects! Summarize recent MEMORY/ToDo."},"delivery":{"mode":"announce"},"sessionTarget":"main","task":"refresh_memory"}' ``` 4. Test: `cron action=run jobId=agents-refresh-daily` or wait for heartbeat. ## Rotate Checks (In Heartbeat) - 6AM/9AM, 1PM, 8PM: Reload AGENTS→IDENTITY/SOUL chain + Update MEMORY/ToDo. - Distill recent memory/YYYY-MM-DD.md → MEMORY.md. ``` `README.md:10-15`: ```markdown 3. Cron auto from manifest.yaml or manual `cron add` (copy from Quick Start). ## Usage - **Auto:** 6AM cron reloads AGENTS/IDENTITY/SOUL + MEMORY distillation. - **Manual:** `session_status` → edit HEARTBEAT.md → cron test run. - **Heartbeat:** 4h rotate (9AM/1PM/8PM) for long-session personality keep. ``` ### Technical Analysis The skill declares a recurring cron schedule in its manifest and separately ins ...[truncated 2129 chars]
• Remediation: ## Remediation Suggestions 1. Remove the automatic `schedules` entry from `manifest.yaml`. 2. Remove the copy-paste `cron action=add` command and heartbeat persistence instructions from `SKILL.md`. 3. Make memory refreshes explicitly user-initiated and limited to a single execution. 4. Before writing `MEMORY.md`, present the proposed changes and require explicit user confirmation. 5. Do not modify `HEARTBEAT.md` unless the user separately authorizes that exact persistent change. 6. If scheduling is essential, use an opt-in installation flow that clearly identifies the schedule, target session, files accessed, retention period, and removal procedure. 7. Provide a reliable uninstall operation that deletes the scheduled job and removes installed heartbeat entries. 8. Apply least privilege by granting access only to files selected for a specific refresh rather than all identity, user, and historical memory files by default. 9. Add safeguards preventing distilled log content from being treated as executable instructions or immutable agent rules.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Scope Creep

High

• Confidence: 96% confidence
• Finding: The manifest only declares write access to MEMORY.md and HEARTBEAT.md, but the skill's documented behavior states it will 'distill yesterday's logs' from files under memory/*.md. If the implementation updates or rewrites those logs as part of refresh/organization, that would exceed the declared write scope. This is a permissions mismatch relative to the manifest's explicit write list.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

# Agents Refresh v1.1.1 💎                                                             
                                                                                          
   ## Overview                                                                            
   A skill for "distilling" AI agent memory.                                              
   Discarding the old idea of "deleting unnecessary info," it specializes in **extracting

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

# Agents Refresh v1.1.1 💎                                                             
                                                                                          
   ## Overview                                                                            
   A skill for "distilling" AI agent memory.                                              
   Discarding the old idea of "deleting unnecessary info," it specializes in **extracting

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

# Agents Refresh v1.1.1 💎                                                             
                                                                                          
   ## Overview                                                                            
   A skill for "distilling" AI agent memory.                                              
   Discarding the old idea of "deleting unnecessary info," it specializes in **extracting

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

# Agents Refresh v1.1.1 💎                                                             
                                                                                          
   ## Overview                                                                            
   A skill for "distilling" AI agent memory.                                              
   Discarding the old idea of "deleting unnecessary info," it specializes in **extracting

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

# Agents Refresh v1.1.1 💎                                                             
                                                                                          
   ## Overview                                                                            
   A skill for "distilling" AI agent memory.                                              
   Discarding the old idea of "deleting unnecessary info," it specializes in **extracting

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

# Agents Refresh v1.1.1 💎                                                             
                                                                                          
   ## Overview                                                                            
   A skill for "distilling" AI agent memory.                                              
   Discarding the old idea of "deleting unnecessary info," it specializes in **extracting

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

# Agents Refresh v1.1.1 💎                                                             
                                                                                          
   ## Overview                                                                            
   A skill for "distilling" AI agent memory.                                              
   Discarding the old idea of "deleting unnecessary info," it specializes in **extracting

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README explicitly describes automated and recurring updates to persistent files such as MEMORY.md, AGENTS/IDENTITY/SOUL, and HEARTBEAT.md, but it does not clearly warn users that installation enables modification of long-lived user/agent state. In a skill context, silent or underexplained persistence changes can cause unintended retention, corruption of agent behavior, or privacy issues because users may trigger the skill without understanding the write scope.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the operator to edit HEARTBEAT.md and install a recurring cron job that will repeatedly read and summarize workspace files, but it does not clearly warn that this creates ongoing automated behavior and persistent file modifications. In a security-sensitive agent environment, silently normalizing persistence and self-refresh behavior can lead to unreviewed context ingestion, unintended disclosure of sensitive local content into agent memory, and surprise background actions long after the initial install.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This skill is configured to run automatically every day and modify persistent memory files without any visible user-facing disclosure or consent indicator in the manifest. Silent scheduled writes can alter agent state, overwrite prior context, or introduce unreviewed summaries and 'lessons,' making downstream behavior less predictable and harder to audit.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: The cron payload hard-codes the Asia/Tokyo timezone, which can cause the task to run at unexpected local times for most users. While not directly exploitable on its own, unexpected execution timing increases the risk of unattended file reads or modifications occurring when the operator does not expect them, especially combined with the persistent refresh behavior described elsewhere in the skill.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The schedule specifies timezone: Asia/Tokyo, which imposes a specific locale setting in natural-language behavior without any evidence of user opt-in or documented regional justification. This can violate locale policy when the skill is not clearly region-specific.

Static analysis

No suspicious patterns detected.