agents-refresh

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:56 AM UTC
• Version: 1.1.1

Overview

This skill is not clearly malicious, but it needs review because it sets up recurring tasks that read user and agent memory files and update long-lived memory automatically.

Install only if you want an automated memory-maintenance skill that can repeatedly read identity, user, heartbeat, and historical memory files and rewrite MEMORY.md. Review the cron and HEARTBEAT.md steps first, back up existing memory files, and prefer a manual or review-before-write workflow unless you intentionally want ongoing scheduled updates.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

• Location: manifest.yaml:9

Finding

Persistent Scheduled Agent Memory Refresh

Content

View full analysis

Vulnerability Details

File Location: manifest.yaml:9-13; supporting installation instructions at SKILL.md:49-64 and README.md:10-15
Vulnerability Type: Persistent scheduled task affecting agent state
Risk Level: High

Vulnerable Code

manifest.yaml:9-13:

yaml

schedules:
  - cron: "0 6 * * *"
    task: "refresh_memory"
    description: "Every morning at 6AM, distill yesterday's logs and update MEMORY.md"
    timezone: "Asia/Tokyo"

SKILL.md:49-64:

markdown

## Workflow (Manual)
1. 📊 `session_status` → Check context length.
2. **HEARTBEAT.md Edit Example:**
   ```
   - [ ] Refresh: read workspace/{AGENTS.md,IDENTITY.md,SOUL.md,USER.md} → Chain SOUL/USER/IDENTITY + Summarize MEMORY (rotate: 4h, 9AM/1PM/8PM)
   ```
3. **Cron Add Command (copy-paste to exec):**
   ```
   cron action=add job='{"name":"agents-refresh-daily","schedule":{"kind":"cron","expr":"0 6 * * *","tz":"Asia/Tokyo"},"payload":{"kind":"systemEvent","text":"[Daily Refresh🐾] read workspace/{AGENTS.md,IDENTITY.md,SOUL.md,USER.md}! Reload SOUL/USER/IDENTITY chain → Keep focus on ToDo/projects! Summarize recent MEMORY/ToDo."},"delivery":{"mode":"announce"},"sessionTarget":"main","task":"refresh_memory"}'
   ```
4. Test: `cron action=run jobId=agents-refresh-daily` or wait for heartbeat.

## Rotate Checks (In Heartbeat)
- 6AM/9AM, 1PM, 8PM: Reload AGENTS→IDENTITY/SOUL chain + Update MEMORY/ToDo.
- Distill recent memory/YYYY-MM-DD.md → MEMORY.md.

README.md:10-15:

markdown

3. Cron auto from manifest.yaml or manual `cron add` (copy from Quick Start).

## Usage
- **Auto:** 6AM cron reloads AGENTS/IDENTITY/SOUL + MEMORY distillation.
- **Manual:** `session_status` → edit HEARTBEAT.md → cron test run.
- **Heartbeat:** 4h rotate (9AM/1PM/8PM) for long-session personality keep.

Technical Analysis

The skill declares a recurring cron schedule in its manifest and separately ins ...[truncated 2129 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the automatic schedules entry from manifest.yaml.
2. Remove the copy-paste cron action=add command and heartbeat persistence instructions from SKILL.md.
3. Make memory refreshes explicitly user-initiated and limited to a single execution.
4. Before writing MEMORY.md, present the proposed changes and require explicit user confirmation.
5. Do not modify HEARTBEAT.md unless the user separately authorizes that exact persistent change.
6. If scheduling is essential, use an opt-in installation flow that clearly identifies the schedule, target session, files accessed, retention period, and removal procedure.
7. Provide a reliable uninstall operation that deletes the scheduled job and removes installed heartbeat entries.
8. Apply least privilege by granting access only to files selected for a specific refresh rather than all identity, user, and historical memory files by default.
9. Add safeguards preventing distilled log content from being treated as executable instructions or immutable agent rules.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Scope Creep

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest only declares write access to MEMORY.md and HEARTBEAT.md, but the skill's documented behavior states it will 'distill yesterday's logs' from files under memory/*.md. If the implementation updates or rewrites those logs as part of refresh/organization, that would exceed the declared write scope. This is a permissions mismatch relative to the manifest's explicit write list.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · README.md (reported line 2)May include surrounding context.

md

# Agents Refresh v1.1.1 💎                                                             
                                                                                          
   ## Overview                                                                            
   A skill for "distilling" AI agent memory.                                              
   Discarding the old idea of "deleting unnecessary info," it specializes in **extracting

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · README.md (reported line 7)May include surrounding context.

md

# Agents Refresh v1.1.1 💎                                                             
                                                                                          
   ## Overview                                                                            
   A skill for "distilling" AI agent memory.                                              
   Discarding the old idea of "deleting unnecessary info," it specializes in **extracting

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · README.md (reported line 12)May include surrounding context.

md

# Agents Refresh v1.1.1 💎                                                             
                                                                                          
   ## Overview                                                                            
   A skill for "distilling" AI agent memory.                                              
   Discarding the old idea of "deleting unnecessary info," it specializes in **extracting

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · README.md (reported line 17)May include surrounding context.

md

# Agents Refresh v1.1.1 💎                                                             
                                                                                          
   ## Overview                                                                            
   A skill for "distilling" AI agent memory.                                              
   Discarding the old idea of "deleting unnecessary info," it specializes in **extracting

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · README.md (reported line 22)May include surrounding context.

md

# Agents Refresh v1.1.1 💎                                                             
                                                                                          
   ## Overview                                                                            
   A skill for "distilling" AI agent memory.                                              
   Discarding the old idea of "deleting unnecessary info," it specializes in **extracting

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

md

# Agents Refresh v1.1.1 💎                                                             
                                                                                          
   ## Overview                                                                            
   A skill for "distilling" AI agent memory.                                              
   Discarding the old idea of "deleting unnecessary info," it specializes in **extracting

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · README.md (reported line 34)May include surrounding context.

md

# Agents Refresh v1.1.1 💎                                                             
                                                                                          
   ## Overview                                                                            
   A skill for "distilling" AI agent memory.                                              
   Discarding the old idea of "deleting unnecessary info," it specializes in **extracting

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README explicitly describes automated and recurring updates to persistent files such as MEMORY.md, AGENTS/IDENTITY/SOUL, and HEARTBEAT.md, but it does not clearly warn users that installation enables modification of long-lived user/agent state. In a skill context, silent or underexplained persistence changes can cause unintended retention, corruption of agent behavior, or privacy issues because users may trigger the skill without understanding the write scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the operator to edit HEARTBEAT.md and install a recurring cron job that will repeatedly read and summarize workspace files, but it does not clearly warn that this creates ongoing automated behavior and persistent file modifications. In a security-sensitive agent environment, silently normalizing persistence and self-refresh behavior can lead to unreviewed context ingestion, unintended disclosure of sensitive local content into agent memory, and surprise background actions long after the initial install.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This skill is configured to run automatically every day and modify persistent memory files without any visible user-facing disclosure or consent indicator in the manifest. Silent scheduled writes can alter agent state, overwrite prior context, or introduce unreviewed summaries and 'lessons,' making downstream behavior less predictable and harder to audit.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The cron payload hard-codes the Asia/Tokyo timezone, which can cause the task to run at unexpected local times for most users. While not directly exploitable on its own, unexpected execution timing increases the risk of unattended file reads or modifications occurring when the operator does not expect them, especially combined with the persistent refresh behavior described elsewhere in the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The schedule specifies timezone: Asia/Tokyo, which imposes a specific locale setting in natural-language behavior without any evidence of user opt-in or documented regional justification. This can violate locale policy when the skill is not clearly region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.