skiptrain

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 1.0.0

Overview

The skill is coherent and not malicious, but it asks an agent to create or update persistent memory files that could shape future agent behavior without clear confirmation or rollback.

Install only if you want this skill to write or update durable Skip/skipsai training memory. Review the target /memory/ files first, prefer a project-scoped memory directory, and require explicit confirmation before overwriting existing memory doctrine.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:151
• Finding: Persistent Agent Doctrine Modification Through Shared Memory Files## Vulnerability Details **File Location**: `SKILL.md`, lines 151-211 **Vulnerability Type**: Persistent agent memory modification **Risk Level**: Medium ### Vulnerable Code ```markdown ## Memory Structure When Skip produces durable knowledge, instruct it to save Markdown files in this structure: ```text /memory/ skipsai/ business/ clients/ offers/ performance/ delivery/ bugs/ prompts/ audits/ case-studies/ skip/ system/ patterns/ checklists/ debugging/ performance/ coding-rules/ prompt-library/ ``` Every saved Markdown file should include: - Title - Date - Purpose - Key rules - Examples - How to use this later Update existing files when improving an existing idea. Do not create duplicates for the same concept. ## Readiness Pass Before Skip builds anything, ask it to perform a readiness pass. Use this prompt: ```text Skip, before you start building, prove you have digested your operating doctrine. Create or update these memory files: - /memory/skip/system/skip-operating-doctrine.md - /memory/skip/patterns/presenter-coordinator-storage.md - /memory/skip/checklists/prelaunch-qa-checklist.md - /memory/skip/performance/core-web-vitals-targets.md - /memory/skip/debugging/index-search-debugging-method.md - /memory/skipsai/delivery/static-site-launch-process.md - /memory/skipsai/business/truthful-positioning.md For each file, include purpose, key rules, examples, when to use it, and common failure modes. Then produce a Skip Readiness Report with: - What you understand your role to be - The performance targets you will enforce - The bug-prevention process you will follow - The files you created or updated - The questions you must ask before any client build - The checks you must run before delivery Do not build yet. Wait after the readiness report. ``` ``` ### Technic ...[truncated 2171 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit user confirmation before creating, updating, or deleting any persistent memory file. 2. Replace shared absolute paths with a project-scoped directory, such as `./memory/skip-trainer/`, unless the user expressly approves a broader scope. 3. Display the target paths and proposed content changes before writing. 4. Use create-only behavior by default. Require separate approval before overwriting or merging into an existing file. 5. Create backups or versioned revisions before modifying existing memory. 6. Validate and canonicalize every destination path to prevent writes outside the approved memory root. 7. Record the source skill, timestamp, user authorization, and change summary in each generated file. 8. Treat persisted skill-generated doctrine as untrusted input when loading it in later sessions. 9. Provide a rollback procedure that identifies and removes every memory change made by the readiness pass. 10. Rewrite the readiness instruction to permit report generation without requiring memory writes, making persistence an explicit opt-in operation.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Cannot explain root causes
- Treats accessibility as optional
- Creates duplicate memory files
- Claims success without verification

## Final Instruction

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.