Extracts durable workflow preferences and project conventions from a session, then proposes the smallest valid update to global or project CLAUDE.md files. Trigger when the user asks to remember rules, when repeated preference patterns appear, or at session end for non-trivial sessions.

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:38 AM UTC
• Version: 1.0.3

Overview

This markdown-only skill transparently helps propose small CLAUDE.md memory updates, with persistence disclosed and scoped by confirmation safeguards.

Before installing, understand that this skill is meant to change future agent behavior by updating CLAUDE.md. Review proposed rule changes carefully, keep confirmation enabled, and avoid enabling automatic session-end writes unless you trust the workflow and are comfortable with durable memory updates.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

- Instruction-only skill; no bundled scripts or external services required
- No credentials, API keys, or network access required for normal use
- Does not modify system configuration; may propose writing to `CLAUDE.md` files after user confirmation
- Optional session-end automation belongs in README only and is not required for core skill behavior

## Quick Reference

Persistent Context Injection

Medium

• Category: Memory Poisoning
• Confidence: 86% confidence

Finding

The skill is designed to persist behavioral instructions into durable CLAUDE.md memory, which creates a real persistent-context injection risk if adversarial or mistaken instructions are misclassified as reusable preferences. Even with filtering guidance, writing permanent instructions based on session content can poison future sessions across tasks or projects.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md

Use one consistent threshold:

- Explicit correction or explicit permanent instruction -> `[stable]`
- Same reusable preference observed 2 times across meaningfully different tasks -> `[tentative]`
- Same reusable preference observed 4 times across multiple task contexts -> `[stable]`

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

md

Then wait for confirmation before writing.

Skip confirmation only when:

- the user explicitly says to update directly, or
- the skill is running automatically at session end with prior permission to write

Persistent Context Injection

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.

Content

Scanner excerpt · references/details.md (reported line 24)May include surrounding context.

md

Use one consistent standard:

- explicit correction or explicit permanent instruction -> `[stable]`
- same reusable preference observed 2 times across meaningfully different tasks -> `[tentative]`
- same reusable preference observed 4 times across multiple task contexts -> `[stable]`

Static analysis

No suspicious patterns detected.