T02 · Agent Memory Poisoning
Warning
- Location
references/safety-and-evolution.md:82- Finding
Unapproved Persistent Modification of the Skill Knowledge Base
- Content
View full analysis
- Remediation
View remediation
Security audit
Career Counselor
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent career-advice skill, but it asks the agent to permanently update its own reference files from web search results, which should be reviewed before installation.
Install only if you are comfortable with a Chinese mainland graduate career counselor that uses live web searches and asks for personal career context, including family constraints. Run it with packaged skill files read-only or disable self-evolution unless updates are reviewed and approved; otherwise web misinformation could be persisted into later advice.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (18)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger text is broad enough to activate on generic distress or uncertainty phrases such as '对未来很迷茫' and '我快毕业了不知道干什么', which can cause the skill to engage when the user did not explicitly seek career counseling. In an agentic runtime, over-triggering can redirect conversations, collect unnecessary personal context, or crowd out a more appropriate safety- or mental-health-oriented skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill is framed exclusively around domestic Chinese graduate employment and uses locale-specific assumptions without requiring user confirmation. If invoked for users outside that context, it can produce misrouted advice, incorrect labor-market assumptions, and unnecessary collection of region-specific personal information.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The entire document is written as prescriptive skill guidance in Chinese, with no indication that the user may choose another language or locale. Under the policy rule, a skill that implicitly enforces a specific language without opt-in can be a natural-language policy violation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The phrase at this location encourages activation from very broad, everyday expressions of uncertainty about the future. In an agent-routing context, overly vague triggers can cause the skill to activate when the user did not intend career counseling, leading to misrouting, unnecessary collection of personal context, or irrelevant guidance. The career-counselor context makes this somewhat plausible because such phrases are common among students, but the broad wording still increases accidental invocation risk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The activation examples include very broad, everyday phrases such as being unsure about the future or not knowing what to do after graduation. This can cause the skill to trigger when the user is expressing general anxiety or seeking broader life advice, leading to over-collection of personal background details and inappropriate routing into a structured counseling flow. In a career-counseling skill, this is more dangerous because the protocol explicitly asks for sensitive socioeconomic, academic, and constraint-related information once activated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The entire skill file is written in Chinese and presents all guidance exclusively in that language, with no indication that language is selectable or that the skill is intentionally limited to Chinese-speaking users. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file begins with a Chinese-only title and all procedural instructions are written in Chinese, indicating the skill is intended to operate in that language by default. There is no statement offering multilingual use, user language selection, or justification for a Chinese-only locale, which matches the language/locale policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file mandates Chinese-only output formats for all interactions without indicating any user language preference check or locale fallback. This can cause unsafe or unusable behavior for users who do not read Chinese, leading to misunderstanding of career advice, consent issues, or inability to verify important guidance.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The content is entirely written for a Chinese context and assumes Chinese language, family dynamics, and employment norms without offering any mechanism to adapt to the user's language or locale. This can cause the agent to respond in an unsuitable language or with culturally mismatched advice, degrading usability and potentially misleading users outside the intended audience.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The entire skill guidance is written to address users as '同学' and prescribe fixed response phrasing only in Chinese, with no indication that the user may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language locale violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file instructs the skill to persistently modify its own reference materials based on live searches and prior interactions, which expands scope from answering career questions into changing future behavior. Even with stated write checks, this creates a self-modification channel that can let low-quality, manipulated, or adversarial information become part of the skill’s long-term guidance, increasing drift and poisoning risk over time.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The capability to update internal references is not necessary for providing career counseling in a single session, so it introduces extra attack surface without clear functional need. An attacker could steer searches or inputs toward content that satisfies weak validation rules and thereby influence stored guidance used for later users.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file is entirely written in Chinese and instructs the agent to interact in Chinese without indicating any language preference detection, opt-in, or fallback behavior. This can exclude or confuse users who communicate in other languages and may cause the system to ignore explicit user language preferences, which is a genuine safety and usability issue even though it is not a classic security exploit.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown content presents all guidance in a single forced language, which can violate language/locale policy when no user opt-in or alternative is provided. The document does not indicate that it is region-specific or that Chinese is an intentional, documented constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The entire skill instruction set is written as mandatory Chinese-facing guidance, including repeated directives to address users as "同学" and provide outputs in that mode, but it does not state that language choice is optional. Under the policy criteria, a skill that effectively enforces a specific language or locale without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
The metadata requires the agent to address the user as “同学,” imposing a specific linguistic style by default. While minor, this is still a language/style constraint without user opt-in and can conflict with organizational language/locale choice expectations.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations in natural-language content. This markdown file presents all guidance exclusively in Chinese, and nowhere indicates that the skill is China-specific or that users may opt into another language.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
该文件是自然语言说明文档，标题和全部正文均强制使用中文，未见提供多语言选项、适用人群说明或要求用户自行选择语言。根据规则，若技能在未获用户 opt-in 的情况下强制特定语言，属于需要标记的自然语言策略问题。
- Content