Back to skill

Security audit

Live Evo: Online Evolution with verified experiences

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent local memory tool, but it broadly stores and reuses task history in a persistent home-directory database without enough user control or data-safety boundaries.

Review before installing. This skill keeps a long-lived local memory of task content in ~/.live-evo and may later surface that content as guidance, so avoid using it for secrets, proprietary code, personal data, incident details, or untrusted user feedback unless you add consent, redaction, deletion, and stronger prompt-injection handling.

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T02 · Agent Memory Poisoning

Error
Location
scripts/experience_manager.py:71
Finding

Persistent Agent Memory Poisoning Through Untrusted Experience Content

Content
View full analysis
Dict: """Add a new experience to the database.""" ensure_dirs() exp = { "id": generate_id(question + datetime.now().isoformat()), "question": question, "failure_reason": failure_reason, "improvement": improvement, "missed_information": missed_information, "category": category, "weight": INITIAL_WEIGHT, "created_at": datetime.now().isoformat(), "use_count": 0, "success_count": 0, } with open(DB_PATH, 'a') as f: f.write(json.dumps(exp, default=str) + "\n") return exp ``` ```python def generate_guideline(task_title: str, experiences: List[Dict]) -> str: """ Generate a task-specific guideline from experiences. """ if not experiences: return "" lines = ["## Task-Specific Guidelines (from past experiences)\n"] for i, exp in enumerate(experiences, 1): lines.append(f"### Lesson {i} (weight: {exp.get('weight', 1.0):.2f})") lines.append(f"**From similar task:** {exp.get('question', '')[:100]}") if exp.get('failure_reason'): lines.append(f"**What went wrong:** {exp.get('failure_reason', '')}") if exp.get('improvement'): lines.append(f"**Key lesson:** {exp.get('improvement', '')}") if exp.get('missed_information'): lines.append(f"**Don't forget:** {exp.get('missed_information', '')}") lines.append("") lines.append("---") lines.append("**Apply these lessons to your current task. Be cautious about over-generalizing.**") return ...[truncated 3391 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:31
Finding

Shell Command Injection Risk in Dynamic Command Templates

Content
View full analysis
/retrieve.py --query "YOUR_TASK_DESCRIPTION" ``` ```bash python /update.py \ --task "TASK_DESCRIPTION" \ --result-a "RESULT_WITHOUT_MEMORY" \ --result-b "RESULT_WITH_GUIDELINE" \ --correct "CORRECT_ANSWER" \ --experience-ids "id1,id2,..." ``` ```bash python /add_experience.py \ --question "THE_TASK_QUESTION" \ --failure-reason "What went wrong (from feedback)" \ --improvement "Key lesson learned" \ --category "coding|analysis|prediction|debugging|other" ``` ```bash python /add_experience.py \ --question "THE_TASK_QUESTION" \ --failure-reason "What went wrong" \ --improvement "Key lesson learned" \ --category "coding|analysis|prediction|debugging|other" ``` ### Technical Analysis The placeholders represent values that can include user-controlled task descriptions, feedback, answers, or results. The documented workflow places these values inside a shell command rather than passing them through a non-shell argument array or a structured input channel. Double quotes do not make arbitrary input safe for shell evaluation. Command substitution forms such as `$(command)` and backticks are still evaluated inside double quotes. An embedded double quote can also terminate the quoted argument and expose subsequent shell metacharacters. The Python scripts themselves use `argparse` and do not invoke a subprocess with these fields. The vulnerable boundary is the documented Bash invocation: shell parsing occurs before Python receives the values. Exploitation is therefore contingent on an Agent copying attacker-controlled text into the templates without applying robust shell escaping. ### Attac ...[truncated 1525 chars]
Remediation
View remediation
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description presents a broader autonomous memory system that learns from completed verifiable tasks and uses stored experiences to provide relevant guidance for future tasks. The supplied code chunk, however, only implements a script to list existing experiences from storage, with optional filtering, sorting, limiting, and detailed display. It does not show any logic for learning, evolving memory, verifying outcomes, retrieving contextually relevant experiences for a task, or generating guidelines. While listing experiences could be a supporting administrative function within such a system, this specific code chunk’s actual purpose is materially narrower and different from the declared description.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The description says to use the skill 'when completing tasks where you can verify the outcome' and lists broad domains like coding, predictions, and analysis. This is expansive and lacks exclusion conditions or concrete trigger phrases, making invocation scope ambiguous for many everyday task requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly stores experience data persistently in a user home directory but provides no user-facing warning, consent step, or sensitivity restrictions. This creates a realistic risk that prompts, feedback, code snippets, secrets, or personal data will be retained indefinitely and later exposed through retrieval, inspection, backup systems, or multi-task reuse.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Persisting natural-language task content in a long-lived JSONL database creates a direct data retention and leakage surface. Because the stored fields include task questions and lessons learned, the database can capture sensitive user inputs in plain language and make them available to future retrieval operations or anyone with filesystem access.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The workflow instructs the agent to store task questions, failure reasons, improvements, and user feedback 'whenever a task fails' and even says 'When in Doubt, Store,' which strongly biases toward over-collection. In the context of a broadly invocable skill for coding and analysis tasks, this materially increases the chance of capturing secrets, proprietary code, incident details, or personal data and later reproducing them through search or listing commands.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The code persists user-supplied question, failure_reason, improvement, and related fields into ~/.live-evo/experience_db.jsonl without any notice, consent flow, minimization, or retention controls. In a memory/learning skill, these fields can easily contain sensitive prompts, proprietary code, credentials, or personal data, so silent long-term local storage creates a real privacy and data exposure risk even though the write is not directly exfiltrating data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The weight-history log appends persistent metadata about which experiences were used and whether they helped, creating a behavioral audit trail in ~/.live-evo/weight_history.jsonl without user-facing warning. While lower sensitivity than full prompt content, this still reveals usage patterns, timestamps, and task success signals that may leak workflow details over time.

Content

No source excerpt is available for this finding.