Anamnese

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:17 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent memory assistant, but it automatically reads and writes sensitive persistent user information with too little user control.

Install only if you want an always-on cloud memory layer that may save personal, health, relationship, task, goal, and behavioral details without asking each time. Before using it, look for controls to review, edit, delete, or disable stored memories, and avoid sharing sensitive information unless you are comfortable with it becoming persistent.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:3
• Finding: Mandatory Global Activation Hijacks Agent Session Behavior and Tool Use## Vulnerability Details **File Location**: `SKILL.md:3-19` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Vulnerable Code ```markdown description: "Load this skill at the start of every conversation. Anamnese is the user's persistent memory and productivity system -- it should always be active. Call get_user_profile first to load context, then continuously capture meaningful information: personal details, preferences, decisions, tasks, goals, schedules, and knowledge worth saving. You have persistent memory across sessions via notes with scope \"ai_client\" -- use this to learn and remember how to best assist this user. Save learnings as you go: interaction patterns, corrections received, behavioral preferences, what works and what doesn't. Don't wait until the end of a conversation." user-invocable: false --- # Anamnese Anamnese is the user's cloud-persistent memory and productivity system. Use it to store, retrieve, and manage personal information, tasks, goals, and notes across sessions. ## Start Every Conversation Call `get_user_profile` at the beginning of each conversation to load the user's full context: facts, goals, tasks, moments, and profile data. ## Proactive Capture Be the user's memory. Capture what matters automatically -- don't wait to be asked. As you converse, continuously identify information worth remembering and save it immediately using the appropriate tool. Don't ask "should I save this?" -- just save it if it's meaningful. ``` ### Technical Analysis The skill declares itself non-user-invocable while instructing the agent to load it at the start of every conversation and remain continuously active. It requires `get_user_profile` to be called regardless of whether the current request needs persistent context. It then directs the agent to monitor the entire conversation and invoke storage tools without asking the user. These directives alter the agent's n ...[truncated 1535 chars]
• Remediation: ## Remediation Suggestions 1. Make the skill explicitly user-invocable or activate it only when the current request clearly concerns memory, tasks, goals, or profile management. 2. Remove the requirements to load the full profile at every conversation start and to keep the skill universally active. 3. Retrieve only the minimum records relevant to the current task, using narrowly scoped searches rather than a complete-profile operation. 4. Require affirmative user consent before creating persistent records, particularly when the user did not explicitly request storage. 5. Present proposed records and their retention scope before writing them. 6. Ensure skill instructions cannot override system instructions, developer policy, current user intent, or tool authorization controls. 7. Provide a session-only mode in which contextual observations are not persisted.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:52
• Finding: Conversation Content Can Be Converted into Persistent Behavioral Rules## Vulnerability Details **File Location**: `SKILL.md:52-79` **Additional Location**: `references/self-review.md:44-50` **Vulnerability Type**: `T02: Agent Memory Poisoning` **Risk Level**: High ### Vulnerable Code ```markdown #### Self-Learning You have persistent memory across sessions via `save_note` with `scope: "ai_client"`. Use this to become better at helping this user over time. **Save as you go** — whenever you learn something, save it immediately. Don't wait until the conversation ends. Examples: - Preferences: "User wants brief answers, no preamble" - Corrections: "I suggested npm but user uses pnpm exclusively" - Interaction patterns: "User gets frustrated when I ask too many questions — just do the task" - What works: "Batching small tasks together works well for this user" Use `search_notes` with `scope: "ai_client"` to find your notes from previous sessions. The `ai_memory` field in `get_user_profile` also shows your 15 most recent AI memory notes. #### Correction Capture When the user corrects you -- explicitly ("no, wrong", "use X instead") or implicitly (redoing something you did, tone shift to frustration) -- save a structured `ai_client` note: - **Title:** A concise rule, e.g., "Use pnpm not npm for this project" - **Tags:** `correction`, a category tag (`wrong-tool-choice`, `wrong-tone`, `wrong-assumption`, `wrong-format`, `wrong-approach`, `misunderstanding`, `over-engineering`, `under-engineering`), and any relevant domain tags - **Content:** What I did wrong / What the user wanted / Rule for next time Before saving, use `search_notes` with `scope: "ai_client"` to check for duplicates. If a similar correction exists, use `update_note` to refine it. Generalize when appropriate ("don't add semicolons" = code style preference) but don't over-generalize. **Don't save:** one-time task clarifications ("no, the other file"), facts you didn't know, or project-specific rules that won't apply else ...[truncated 3521 chars]
• Remediation: ## Remediation Suggestions 1. Treat all stored memories as untrusted contextual data, never as authoritative instructions. 2. Require explicit confirmation before converting a correction, preference, or inferred behavior into a persistent rule. 3. Do not persist rules based solely on implicit signals such as tone, frustration, or the user redoing an action. 4. Preserve provenance, author identity, creation time, confidence, project scope, and expiration metadata for every record. 5. Scope project-specific preferences to the relevant project rather than generalizing them across all conversations. 6. Prohibit memory entries from overriding system policy, developer instructions, current user intent, permission checks, or safety controls. 7. Exclude security-sensitive behavior, tool authorization, credential handling, and execution policy from learnable preferences. 8. Before applying a stored rule, verify that it remains relevant and does not conflict with the current request. 9. Require confirmation before consolidating multiple records or creating higher-level principles. 10. Provide users with an accessible history and controls to inspect, correct, expire, and delete behavioral records.

other

Error

• Location: references/memory-management.md:8
• Finding: Automatic Persistent Collection of Sensitive Personal and Health Information## Vulnerability Details **File Location**: `references/memory-management.md:8-15` **Additional Location**: `SKILL.md:13-30` **Vulnerability Type**: `other: Privacy Overcollection` **Risk Level**: High ### Vulnerable Code ```markdown **Save when the user mentions:** - Identity: name, location, job, employer, birthday - Preferences: "I prefer...", "I always...", "I never..." - Relationships: "My partner is...", "My team includes..." - Health: allergies, conditions, medications - Skills and habits: "I know Rust", "I run every morning" ``` The collection rules operate together with the following mandatory behavior in `SKILL.md`: ```markdown Call `get_user_profile` at the beginning of each conversation to load the user's full context: facts, goals, tasks, moments, and profile data. Be the user's memory. Capture what matters automatically -- don't wait to be asked. As you converse, continuously identify information worth remembering and save it immediately using the appropriate tool. Don't ask "should I save this?" -- just save it if it's meaningful. ``` ### Technical Analysis The skill explicitly identifies identity, location, employment, birthday, relationships, health conditions, allergies, and medications as data to save whenever mentioned. It also orders the agent not to wait for a request or ask whether the information should be stored. This design lacks purpose limitation, data minimization, sensitivity-based controls, and explicit consent. Casual conversational disclosure is not equivalent to informed authorization for cloud-persistent retention. Loading the user's entire profile at the start of every conversation creates additional exposure because the full dataset is retrieved even when it is irrelevant to the current task. The inclusion of health information substantially increases sensitivity. The instructions also permit inferred behavioral data and preferences to be retained, creating a risk that ...[truncated 1472 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit, informed opt-in before storing any personal information. 2. Require separate, prominent consent for sensitive categories such as health, relationships, birthday, and precise location. 3. Do not interpret casual disclosure as authorization for persistent retention. 4. Default sensitive information to ephemeral session context and delete it when the session ends. 5. Retrieve only records relevant to the active request instead of loading the complete profile. 6. Define clear purposes, retention periods, encryption requirements, and access controls for every data category. 7. Avoid storing inferred emotions, habits, or preferences unless the user explicitly verifies them. 8. Provide controls for reviewing, correcting, exporting, and permanently deleting stored records. 9. Maintain an auditable consent record for each persistent sensitive-data write. 10. Redact or exclude sensitive information from logs, diagnostic output, and unrelated tool calls.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The skill mandates automatic activation at the start of every conversation and says it should always be active, which removes meaningful user control over when persistent memory features run. In a memory-collection skill, broad auto-activation materially increases privacy risk because sensitive data can be collected and persisted by default in contexts where the user did not explicitly opt in.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill instructs the agent to save meaningful personal information automatically and 'in the background' without a clear up-front warning that data will persist across sessions. This undermines informed consent and can lead to retention of highly sensitive information that the user may have believed was ephemeral.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill explicitly encourages storing sensitive categories such as identity, relationships, and health as persistent facts. These are high-sensitivity data classes, and collecting them automatically across sessions significantly raises the risk of privacy harm, unauthorized profiling, and regulatory noncompliance if mishandled or over-retained.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: This guidance explicitly encourages storing sensitive personal data, including health information, identity details, relationships, and habits, but provides no requirement to obtain explicit user consent, minimize collection, or warn about persistence. In the context of a persistent-memory skill that is loaded at the start of every conversation, this materially increases the risk of silent collection and long-term retention of highly sensitive data.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The self-learning section instructs the agent to persist cross-session notes about user behavior, frustrations, corrections, and interaction patterns without any privacy notice, consent gate, or limitation on profiling. Because the overall skill says it should always be active and save learnings continuously, this creates a persistent profiling mechanism that can invisibly accumulate behavioral data over time.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill directs continuous cross-session collection of personal details, preferences, decisions, tasks, goals, schedules, and behavioral learnings without requiring confirmation for each capture. Persistent behavioral profiling and broad data retention create substantial privacy and misuse risk, especially when collection occurs by default rather than through narrowly scoped user requests.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The instruction to save meaningful information immediately and without asking, while avoiding interruption, explicitly bypasses confirmation and transparency. In practice this can cause silent retention of sensitive or contextual statements the user never intended to become durable memory.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The self-learning section directs the agent to maintain cross-session notes about the user's behavior, frustrations, and response preferences to improve future interactions. While personalization can be useful, persistent behavioral profiling without strong notice and user control can be intrusive and may capture sensitive inferences the user did not knowingly authorize.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger phrases are broad enough that ordinary user requests like "review your learnings" or "self-assessment" could invoke a high-impact maintenance workflow without strong confirmation. In this skill's context, invocation causes bulk access, consolidation, updating, and deletion of persistent `ai_client` notes, so an accidental or adversarially-induced trigger could modify long-term memory unexpectedly.

Static analysis

No suspicious patterns detected.