T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:8- Finding
Persistent Agent Behavior Modification Through SOUL.md
- Content
View full analysis
- Remediation
View remediation
Security audit
表情包回复
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it says by adding meme images, but it also encourages persistent agent behavior that silently contacts and embeds content from an unauthenticated HTTP service.
Install only if you are comfortable with agent-generated mood/context queries and image loads going to the listed third-party HTTP service. Avoid copying the block into SOUL.md unless you intentionally want the behavior to persist across future sessions, and remove that block later to fully disable it.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:39- Finding
Plaintext Communication With an Unauthenticated External Meme Service
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to send generated query text to an external third-party API over plain HTTP without any disclosure or consent mechanism. Because the query is dynamically derived from conversation context and agent state, it can leak contextual or sensitive information in transit and to the remote service, and HTTP additionally exposes the request to interception or tampering.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill tells the agent to embed an image from an external HTTP endpoint directly in responses, which causes the client viewing the response to contact a third-party server. This creates undisclosed outbound network access, exposes user/client metadata such as IP and timing, and because the resource is loaded over HTTP it is also vulnerable to interception or content substitution.
- Content