T02 · Agent Memory Poisoning
Error
- Location
apply_learning.py:66- Finding
Untrusted Hermes Content Is Persisted as High-Importance Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
Hermes Learning
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it says, but it imports another agent's learning text into persistent WorkBuddy memory without enough review, validation, or containment.
Install only if you intentionally want Hermes learning artifacts to modify WorkBuddy's persistent global memory. Review ~/.hermes/shared/memory_summary.json before running apply, avoid unattended daily imports, and be prepared to inspect or delete entries from ~/.workbuddy/memory/evolution.db if bad guidance is imported.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (24)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill advertises file read/write behavior through documented commands and shared state files, but it declares no explicit tool scope or permissions boundary. This increases the chance that an agent runtime will grant broader filesystem access than users expect, reducing transparency and weakening least-privilege controls.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This section describes reading from and writing to cross-agent memory and feedback files, including persistent storage in evolution.db, without warning users that personal, sensitive, or operational data may be copied between agents and retained locally. The danger is amplified by the cross-agent design because data can propagate beyond the user’s immediate context without informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The bidirectional feedback flow explicitly states that feedback and effect reports are written and exchanged with another agent, but it omits a warning that these artifacts persist on disk and may expose user content, behavior, or internal reasoning to another system. Because this is an ongoing feedback loop, the omission can lead to repeated unintended disclosure over time.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The docstrings, status messages, usage text, and user-facing output are consistently in Chinese, with no option for users to select another language. This creates a locale/language policy issue when the skill is used in broader environments that may require user choice rather than a forced language.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script persists externally sourced 'learning' content into local JSON files and a global SQLite database under the user's home directory without any consent prompt, trust boundary check, schema validation, or integrity verification of the source data. In this skill's context, that creates a durable cross-session influence channel: untrusted content from Hermes/shared files can silently shape future agent behavior and remain on disk, which is a real security and safety risk even without code execution.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Natural-language policy checks apply to all file types, including JSON string content. The titles, descriptions, action steps, and recommendations are presented in Chinese throughout the file, with no indication that users may choose another language or that the locale constraint is justified for a region-specific purpose.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This JSON file is a manifest-like data file, so vague-trigger checks apply. The field value "Hermes与WorkBuddy技能协作场景" describes a broad collaboration scenario rather than a specific trigger phrase or bounded activation condition, leaving unclear exactly when the rule should apply versus not apply.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The applicable_when value again uses the broad phrase "Hermes与WorkBuddy技能协作场景" without defining trigger boundaries. Because it lacks specific invocation conditions or non-applicable cases, it risks unintended matching in ordinary cross-system collaboration contexts.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The rule's activation field uses a generic collaboration context rather than a narrowly scoped trigger. This makes it unclear whether any Hermes and WorkBuddy interaction should activate the rule, which is the type of ambiguity this check is meant to catch.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The phrase "Hermes与WorkBuddy技能协作场景" is a high-level context label, not a concrete activation condition. Without specificity, a dispatcher or user could interpret the rule as applicable to almost any cooperative activity involving the two systems.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The value "通用任务执行场景" is extremely broad and overlaps with ordinary work across many skills. It does not specify trigger phrases, contexts, or boundaries, so it could cause unintended invocation in common situations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This applicability field repeats the same generic Hermes/WorkBuddy collaboration context. The lack of a precise trigger or explicit non-trigger conditions makes the rule susceptible to over-application.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest-style condition refers generally to Hermes and WorkBuddy collaboration, but does not define what action, request, or environment should trigger it. This is too open-ended to safely guide invocation or applicability.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The phrase "AI系统间协作场景" describes a sweeping class of situations rather than a specific trigger. Since many ordinary interactions could fit that description, the rule lacks the specificity needed to avoid accidental application.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The value "技能使用与配置场景" is a broad umbrella condition that could cover many unrelated activities. It does not tell the reader or system what exact event activates the rule or when it should be excluded.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The same high-level collaboration phrase appears again without trigger details or negative examples. Repetition of this vague condition across entries increases the risk that multiple rules could activate in an uncontrolled way.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This applicability field again describes only a broad context involving Hermes and WorkBuddy. Because it omits exact trigger conditions, it does not clearly separate intended invocation cases from normal conversation or coordination.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The phrase "Hermes与WorkBuddy技能协作场景" is reused for the optimization rule without specifying what initiates it. This ambiguity can make the rule fire too broadly across unrelated collaboration tasks.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language values in the usage_guidance section are written entirely in Chinese, which imposes a specific language on users without any visible opt-in or explanation that this file is intended only for a Chinese-speaking or region-specific context. This matches the policy category for language or locale constraints appearing in config or content files.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This JSON file contains user-facing natural-language fields such as titles, descriptions, suggestions, and task labels entirely in Chinese. Because the file provides no opt-in, alternative locale, or documented region-specific justification, it may violate the language/locale policy requiring user choice or clear justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This JSON file contains multiple natural-language fields such as pattern, full_content, suggestion, and note that are consistently written in Chinese. Under the policy, forcing a specific language without user opt-in or documented locale justification is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JSON file includes multiple natural-language status and recommendation strings in Chinese, which imposes a specific language on downstream users or tools consuming the file. There is no indication that the skill is region-specific or that users can opt into this locale, so it violates the language/locale policy criteria.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The natural-language note on L5 is written in Chinese and does not indicate that language selection is optional or limited to a documented region-specific context. This can violate language/locale policy expectations when a skill or its artifacts impose a specific language without user choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This JSON file includes human-readable note fields in Chinese at L06, L22, and L50. Because SQP-3 applies to all file types and covers language/locale policy, embedding operational notes in a single language without any user opt-in or documented locale constraint can violate language-choice expectations.
- Content
Static analysis
No suspicious patterns detected.