Daily Memory Save

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:18 PM UTC
• Version: 1.0.6

Overview

This skill is not malicious, but it needs review because it silently saves conversation-derived memories to persistent workspace files.

Install only in a private workspace where you are comfortable with conversation summaries being saved automatically. Consider enabling notification mode, adding explicit redaction rules for credentials and sensitive data, and reviewing or deleting MEMORY.md and memory/ notes regularly.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:40

Finding

Untrusted Conversation Content Can Poison Persistent Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 40-54
Vulnerability Type: Persistent memory poisoning through untrusted conversation content
Risk Level: Medium

Vulnerable Code Snippet:

text

AUTOMATION: Daily memory save. Review today's conversation for anything worth remembering.
Look for: decisions made, preferences expressed, new info about people/projects,
lessons learned, things the user asked you to remember, emotional context worth noting.

Create or update workspace/memory/YYYY-MM-DD.md (today's date) with a daily note
capturing what matters. If anything is significant enough for long-term memory,
also update workspace/MEMORY.md.

Before writing, read the target memory file first. Avoid duplicating existing
sections or substantially similar notes. If a topic already exists, add only
genuinely new details under the existing section. Prefer surgical edits over
rewriting or re-appending the whole file.

If it's been a quiet day with nothing notable, skip silently.
Be selective — capture signal, not noise. Write like future-you will need this context.
Do NOT message the user about this — just do it quietly.

Technical Analysis

The scheduled instruction directs the agent to inspect conversation content and copy selected information into daily and long-term memory files. Conversation content is an untrusted input channel, but the prompt does not require provenance tracking, instruction neutralization, source validation, or user confirmation before writing to MEMORY.md.

An attacker who can contribute content to a conversation can phrase malicious rules, false facts, or behavioral directives as information that should be remembered. If the model considers that content significant, it may persist it in MEMORY.md. Future sessions that consume this file could then treat the attacker-controlled entry as trusted context. The instruction to avoid duplication may also reinforce an e ...[truncated 1090 chars]

Remediation

View remediation

Remediation Suggestions

• Treat all conversation text as untrusted data rather than executable instructions.
• Explicitly prohibit storing commands, role changes, security-policy changes, tool-use directives, or instructions addressed to future agents.
• Require explicit user confirmation before adding or modifying long-term entries in MEMORY.md.
• Store provenance with every memory entry, including the source conversation, author, timestamp, and whether the entry was user-approved.
• Delimit saved material as non-authoritative reference data so future sessions do not interpret it as system-level instructions.
• Validate proposed entries against existing trusted policies and reject content that attempts to weaken safeguards.
• Prefer structured memory fields over unrestricted prose, with an allowlist of permitted data types such as preferences, project facts, and decisions.
• Provide a review and rollback mechanism for newly created memory entries.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:12

Finding

Silent Conversation Persistence Lacks Mandatory Secret and Sensitive-Data Filtering

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-21
Vulnerability Type: Unfiltered persistent storage of potentially sensitive conversation data
Risk Level: Medium

Vulnerable Code Snippet:

text

**Before installing, understand what this skill does:**

- **Main-session access**: This skill runs in your main session and reads your conversation history to extract memories. Only install if you trust your workspace environment.
- **Silent by default**: The default prompt operates silently. If you want notifications when memories are saved, modify the cron prompt (see "Notification Mode" below).
- **Persistent files**: Writes to `memory/YYYY-MM-DD.md` and `MEMORY.md` in your workspace. These contain conversation summaries. Ensure your workspace is private and backed up.
- **No network access**: This skill makes no network calls. It only reads conversation history and writes local files. Your runtime should enforce this — the skill's claim alone is not a security guarantee.
- **No credentials**: This skill does not use or store any API keys, tokens, or secrets.

**Recommended:** Review saved memory files periodically. Delete anything you don't want persisted.

Technical Analysis

The skill has broad access to main-session conversation history and writes derived information to persistent files while operating silently by default. Although the documentation claims that the skill does not store credentials, the operative memory-generation instructions contain no mandatory filtering rule for passwords, API tokens, private keys, authentication cookies, financial information, personal data, or other confidential material.

The absence of intentional credential use does not prevent credentials or sensitive information already present in a conversation from being selected during summarization. Persisting such data expands its lifetime and makes it available to workspace readers, backups, synchronization sy ...[truncated 1410 chars]

Remediation

View remediation

Remediation Suggestions

• Add an explicit instruction that credentials and sensitive personal or business data must never be written to either memory layer.
• Apply secret detection before every write, including patterns for API keys, bearer tokens, passwords, private keys, session cookies, connection strings, and recovery codes.
• Redact sensitive values rather than relying on summarization to omit them.
• Require user approval for entries containing names, contact details, health information, financial information, authentication data, or confidential project content.
• Change notification mode to the default, or provide a concise record of every write and deletion.
• Enforce restrictive filesystem permissions on memory/ and MEMORY.md.
• Define retention and deletion controls, including automatic expiry for daily notes and secure deletion where supported.
• Exclude memory files from source control, public synchronization, diagnostic bundles, and broadly accessible backups.
• Test the filtering behavior with representative secret and personally identifiable information patterns.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly directs silent operation and forbids notifying the user when it reads conversation history and persists summaries to long-lived files. In a privacy-sensitive context, removing disclosure makes it easier to capture and retain sensitive information without contemporaneous user awareness, reducing meaningful consent and detection of over-collection.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

Because this is a markdown file, vague trigger guidance applies. The description says the skill 'Periodically reviews conversation history' but does not, in the primary invocation description, define the exact trigger conditions or limits, which could make activation expectations unclear outside the later cron setup details.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.