T07 · Tool Hijacking and Spoofing
Warning
- Location
scripts/defragment.py:258- Finding
Defragmentation execution falsely reports cleanup operations that are never performed
- Content
View full analysis
- Remediation
View remediation
Security audit
Memory Defragmenter
Security checks for vulnerabilities and agentic risk
Overview
This skill is a memory-maintenance tool, but its execute path can falsely report that sensitive memory was archived or compacted when it only created backups.
Review before installing. The skill does not appear to exfiltrate data or install persistence, but users should not rely on --execute to actually clean or archive memory. Treat it as an analyzer/backup tool unless the implementation is fixed, and protect or manually remove .defrag_backup copies because they may contain sensitive agent memory and identity state.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/defragment.py:35- Finding
Sensitive agent-state backups are retained indefinitely without access-control hardening
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description presents an active maintenance tool that cleans and optimizes memory files. However, the supplied script is an analyzer: it reads files, computes stats, identifies possible stale/duplicate content, and prints recommendations. It never writes to files, deletes duplicates, merges entries, archives stale data, or changes tier placement. The title/docstring also explicitly say 'Analyze memory files for defragmentation opportunities,' which confirms the actual purpose is diagnostic rather than corrective. This is a material description-behavior mismatch because the primary function is different.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description promises active memory maintenance operations: deduplication, merging, archiving, and optimization. The actual code only enumerates .md files in certain memory-related directories, reads their contents, checks simple heuristics (over 200 lines, nearly empty), and reports issues. It does not modify files, move content, archive anything, compare entries for duplication/similarity, or enforce tier placement. This is a materially different primary purpose: post-defragmentation integrity verification rather than defragmentation/optimization itself.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill clearly instructs the agent to read and modify memory files and to run local scripts that perform planning, execution, backup, archiving, and verification, but it declares no tool scope or permissions. That creates an authorization ambiguity where a consumer may approve or invoke the skill without realizing it has file read/write effects, increasing the chance of unintended data modification in sensitive memory stores.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module docstring and report branding present this as part of a defragmentation capability, while the implemented behavior is read-only analysis of markdown files. No code in this file performs the manifest-described actions of cleaning duplicates, merging entries, archiving stale content, or ensuring proper tiering; it only counts and reports possible issues.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The top-level docstring explicitly presents --execute as an execution path for cleanup. However, the implementation of execute_defragment only creates backups and prints messages, including a comment stating 'In real implementation, would compact the file,' which confirms cleanup is not actually performed.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest describes a skill that cleans duplicates, merges similar entries, archives stale content, and ensures proper tiering. In execute mode, the code only backs up files and logs actions for archive/compact items; it does not rewrite files, move entries, merge duplicates, archive stale content, or perform any tiering changes.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This code creates a backup directory and copies files into it during execution, which is a file-writing operation affecting the user's filesystem. Although there are status prints at execution time, there is no up-front user-facing warning in the CLI help or argument descriptions that --execute will create backup artifacts under the chosen path.
- Content
Static analysis
No suspicious patterns detected.