context-memory

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:45 AM UTC
• Version: 1.0.1

Overview

The skill is not overtly malicious, but it asks the agent to automatically save and reload personal and workspace memory with weak user controls.

Review before installing. Use this only in workspaces where you are comfortable with the agent saving and reusing personal details, project history, corrections, workflow rules, and tool notes. Keep secrets, tokens, private emails, and sensitive client data out of these memory files, and consider requiring explicit confirmation before any memory write plus a regular review and deletion process.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:41

Finding

Mandatory Global Output and Workflow Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 41-52
Vulnerability Type: Mandatory instruction and response-format override
Risk Level: High

Vulnerable Instruction Snippet

The following is an English rendering of the audited instruction segment:

markdown

### Step Zero: Task Classification Marker (Must Not Be Skipped!)

**Before taking any action on every user message, first output one line identifying the task type in the following format:**

[@task_classify] New task/continued task/casual reply | Task type | Basis for judgment

- `@task_classify` is the classification marker and must appear before any action.
- Do not perform any operation without this marker.
- Continued task = continuation of the same topic; documents do not need to be read again.
- Casual reply = simple confirmation or polite response; no operation is required.

Technical Analysis

The Skill imposes a mandatory response prefix and execution precondition on every user message, including messages unrelated to memory management. The rule that no operation may occur without the marker changes the Agent's global response and tool-execution workflow merely because the Skill has been loaded.

This exceeds the Skill's legitimate context-memory function. It can conflict with higher-priority formatting requirements, structured API output, tool protocols, or task-specific instructions. The requirement is especially disruptive because it applies universally rather than only when memory retrieval is relevant.

Attack Path

1. The Skill is loaded into an Agent session.
2. A user submits any request, including one unrelated to persistent memory.
3. The Skill requires the Agent to emit the injected @task_classify marker before any action.
4. If the marker is omitted because another protocol requires different output, the Skill directs the Agent not to execute the task.
5. The injected workflow therefore alters or bl ...[truncated 433 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the requirement to emit a classification marker in every response.
• Remove the rule that blocks all operations when the marker is absent.
• Perform task classification internally and only when context retrieval is relevant.
• State explicitly that system, developer, security, output-format, and user instructions retain their established priority.
• Do not allow this Skill to alter unrelated response formats or tool protocols.
• If visible classification is useful, make it optional and require explicit user enablement.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:87

Finding

Persistent Memory Poisoning Through Unvalidated Conversation Content

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 87-112
Vulnerability Type: Persistent storage of attacker-controlled instructions
Risk Level: High

Vulnerable Instruction Snippet

The following is an English rendering of the audited instruction segment:

markdown

### Step Four: Execute and Save

- Execute the task.
- Immediately write important information to the corresponding file; do not wait to record it later.
- When the user corrects you, immediately record it in `.learnings/LEARNINGS.md`.

## Memory-Writing Rules

### When files must be written

| Scenario | File | Format |
|----------|------|--------|
| The user corrects you | `.learnings/LEARNINGS.md` | Correction date, content, and correct approach |
| You make a mistake | `.learnings/ERRORS.md` | Error description and solution |
| User preference | `MEMORY.md` or `SOUL.md` | Short rule |
| Tool configuration | `TOOLS.md` | Configuration and precautions |
| Workflow | `AGENTS.md` | Procedural specification |
| Daily summary | `memory/YYYY-MM-DD.md` | Log |

### Writing Principles

1. **Write immediately** — Do not merely say that you remembered it.
2. **Be specific** — Recording a concrete user identity is more useful than recording that the user has a preference.
3. **Classify storage** — Preferences go to `SOUL.md` or `MEMORY.md`; errors go to `ERRORS.md`; corrections go to `LEARNINGS.md`.
4. **Include the date** — This supports traceability.

Technical Analysis

The Skill directs the Agent to persist user-provided preferences, corrections, workflow details, and tool configuration without requiring validation or explicit confirmation. Several target files, particularly SOUL.md, AGENTS.md, TOOLS.md, and .learnings/LEARNINGS.md, can influence future Agent behavior.

The design does not distinguish trusted factual memory from executable behavioral instructions. It also lacks provenance metadata, per-use ...[truncated 1596 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit user confirmation before creating or changing persistent memory.
• Treat all conversation-derived content as untrusted data rather than executable instructions.
• Store factual memory separately from behavioral policies, tool configuration, and security rules.
• Prohibit memory writes that modify instruction priority, disable safeguards, authorize privileged operations, or alter tool security.
• Record provenance, author, timestamp, workspace, applicable user, and intended scope for every memory item.
• Apply per-user and per-project isolation so one user cannot poison another user's context.
• Validate and sanitize entries before persistence, including detection of embedded directives and prompt-injection content.
• Provide review, rollback, expiration, and deletion mechanisms.
• Restrict write access to SOUL.md, AGENTS.md, and TOOLS.md; these files should require trusted administrative approval.
• Load persistent records as quoted reference data and never as instructions with authority equal to trusted policy.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:81

Finding

Overbroad Automatic Access to Workspace Memory and Tool State

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 81-85
Vulnerability Type: Excessive workspace access beyond task-specific need
Risk Level: Medium

Vulnerable Instruction Snippet

The following is an English rendering of the audited instruction segment:

markdown

### Step Three: Read After Confirmation

1. `SOUL.md` + `AGENTS.md` + `MEMORY.md` + `TOOLS.md`
2. `.learnings/ERRORS.md` + `.learnings/LEARNINGS.md`
3. Relevant Skill documentation when LIMS or file sending is involved

Technical Analysis

The Skill directs the Agent to read a broad collection of identity, behavioral, historical, and tool-configuration files whenever a task is classified as new. It does not require a task-specific need for each file and does not define data minimization, user isolation, access-control checks, or secret filtering.

MEMORY.md may contain personal or project information, while TOOLS.md may contain integration details. Loading all such state into the active context makes unrelated information available to a task that may not legitimately require it. It also expands the prompt-injection surface because compromised content in any automatically loaded file can influence the Agent.

Attack Path

1. An attacker initiates a request that is classified as a new task.
2. The Skill instructs the Agent to load all listed workspace files.
3. Unrelated personal information, project history, behavioral instructions, or tool details enter the active Agent context.
4. The attacker uses follow-up questions or prompt-injection techniques to induce disclosure or misuse of the loaded information.
5. If any loaded file was previously poisoned, its instructions can also affect execution of the attacker's task.

Impact Assessment

The affected scope includes all information available in the listed files under the Agent's existing filesystem permissions. Potentially exposed material includes user preference ...[truncated 367 chars]

Remediation

View remediation

Remediation Suggestions

• Replace bulk file loading with task-specific retrieval of only the minimum necessary records.
• Require an explicit relevance check for each file before reading it.
• Separate memory by user, project, tenant, and sensitivity level.
• Exclude credentials, tokens, secrets, and private integration configuration from Agent-readable memory files.
• Apply filesystem access controls so the Skill can read only an approved memory directory.
• Obtain user consent before loading information from unrelated tasks or projects.
• Treat retrieved memory as untrusted reference material and scan it for embedded instructions.
• Add redaction controls to prevent loaded information from being reproduced in responses without authorization.
• Maintain access logs showing which memory records were read for each task.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill explicitly gives an example of storing identifying personal information such as the user's name in persistent memory for later reuse. This is dangerous because it encourages direct retention of personal identifiers in plain files, increasing the risk of over-collection, unauthorized reuse, and disclosure to later tasks, tools, or operators.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 100% confidence

Finding

The BOOTSTRAP template includes persistent fields for user title, time zone, and email, explicitly creating a structure for storing profile and contact data. In this memory skill, that makes the issue more dangerous because these fields are meant to be automatically loaded on future tasks, enabling broad cross-session reuse of personal data without any privacy safeguards.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill's core design is to record and reload memory from filesystem files across sessions, including user preferences and project context. In skill context, this materially increases the danger because it normalizes cross-session persistence without access controls, consent boundaries, or separation between harmless context and personal data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill mandates a fixed Chinese output format for every message before any action, without considering the user's preferred language. This is primarily a usability and policy-compliance issue that can cause confusing disclosures or metadata leakage into user-visible responses, but it is not a severe security flaw by itself.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to persist user information to files but provides no consent, minimization, retention, or sensitivity checks. That creates a privacy and data-governance risk because personal data may be stored indefinitely and reused across unrelated tasks or sessions without the user's awareness.

Content

No source excerpt is available for this finding.