Daily Memory Keeper

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:23 AM UTC
• Version: 1.0.0

Overview

This memory-archiving skill is purpose-aligned, but it asks the agent to automatically index and clean persistent memory without enough user control or recovery detail.

Review this skill carefully before installing. It appears to do what it claims, but it may read, summarize, reuse, and delete agent memory files automatically. Use it only if you are comfortable with memory/ being processed, and prefer changing autoClean to false or requiring explicit confirmation before cleanup.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:41

Finding

Unrestricted Memory Archiving and Automatic Retention-Based Deletion

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 41-46
Vulnerability Type: Unsafe handling and deletion of persistent Agent memory
Risk Level: Medium

Complete Code Snippet:

json

{
  "archiveDir": "memory/",
  "retentionDays": 30,
  "autoClean": true,
  "dailyBriefing": true
}

The documented features also state that the Skill archives memory files by date, supports inheritance of memory across sessions, and periodically deletes expired files.

Technical Analysis

The Skill is documentation-only and contains no executable implementation. Nevertheless, its documented configuration enables automatic cleanup by default and directs the Agent to process the entire memory/ directory. No safeguards are specified for:

• Canonical-path validation or directory allowlisting
• Symbolic-link and path-traversal protection
• Detection and redaction of credentials or other sensitive records
• Encryption and restrictive permissions for generated archives
• Confirmation or preview before deletion
• Backups, recovery, or transactional deletion
• Access boundaries for search results and daily summaries

Agent memory may contain private conversation history, credentials, operational instructions, or other sensitive state. Consolidating those records into searchable archives and cross-session summaries increases their exposure. Automatic retention-based cleanup may also cause irreversible data loss if the configured directory or file-age calculations are incorrect.

Because no implementation is included, this finding concerns the unsafe behavior prescribed by the Skill configuration rather than a demonstrated executable exploit.

Attack Path

1. A user or Agent loads the Skill and requests memory archiving, searching, or a daily briefing.
2. An implementation following the documented behavior enumerates the configured memory/ directory without a defined file-level allowlist.
3. Sensi ...[truncated 982 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user consent before reading, archiving, summarizing, exporting, or deleting memory records.
2. Resolve the archive path canonically and enforce an allowlisted root directory. Reject absolute paths, traversal components, and symbolic links that escape that root.
3. Change autoClean to false by default. Present a deletion preview and require confirmation before destructive actions.
4. Implement backup, quarantine, or recoverable deletion with a documented restoration procedure.
5. Detect and redact credentials, tokens, personal information, and other sensitive content before generating archives, search results, or briefings.
6. Encrypt archived memory at rest and apply restrictive file permissions based on least privilege.
7. Restrict cross-session retrieval to authorized users and narrowly scoped queries.
8. Record auditable metadata for archive, search, access, and deletion operations without logging sensitive content.
9. Add tests for path traversal, symbolic-link escapes, retention boundary errors, concurrent modification, unauthorized retrieval, and failed deletion recovery.
10. Document the exact files eligible for processing and the security boundaries expected from any future implementation.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill advertises automatic cleanup of expired files but does not warn users that stored memory data may be deleted automatically. Because the skill operates on persistent memory archives, undisclosed cleanup behavior can lead to silent data loss, loss of auditability, and unintended deletion of important context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The usage phrase "继续上次的工作" is broad and overlaps with ordinary conversation, which can cause the skill to activate unintentionally during normal agent interactions. In a memory-management skill, accidental activation is more dangerous because it may trigger archival, retrieval, or cleanup behaviors affecting persistent memory without explicit user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The natural-language content and all example invocations are presented only in Chinese, with no indication that users may interact in other languages or opt into this locale. That can violate language or locale policy when the skill appears intended for general use rather than a clearly documented region-specific audience.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.