T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:40- Finding
Unapproved Conversation Content Can Be Written to Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
Dolores 运维工具
Security checks for vulnerabilities and agentic risk
Overview
This operations skill is coherent, but it can read conversation history, persist memory, delete files, and create recurring tasks without strong approval boundaries.
Review this skill before installing. Use it only if you want an assistant maintenance skill that may read past conversations, write long-term memory, clean workspace files, and create recurring cron or heartbeat tasks. Require explicit review of memory entries, exact deletion paths, and cron schedules before allowing those actions, and avoid storing secrets or sensitive conversation details.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases are broad enough to match ordinary requests like '清理工作目录' or '维护你自己', which can activate a high-privilege skill unexpectedly. Since the skill can execute commands, write files, and manage cron, overbroad invocation increases the chance of unintended privileged operations from benign user language.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to review conversation history and persist extracted information into memory files, but it does not provide an upfront warning or consent boundary to the user. This creates a privacy and data-retention risk, especially because conversation-derived notes may include preferences, commitments, or sensitive context the user did not expect to be stored long-term.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill defines a confirmation requirement for deletions, but then weakens it with '用户要求除外', allowing destructive cleanup actions based only on a natural-language request. Because this skill is user-invocable and has exec/write/edit access, ambiguous or socially engineered prompts could cause irreversible file deletion without a separate safety checkpoint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill can create cron jobs that persist and execute over time, yet it does not clearly warn users beforehand that invoking the skill may establish ongoing system-level automation. Persistent scheduled tasks materially increase risk because they can repeatedly perform actions without fresh user review and may survive beyond the original conversation context.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
L097 声明“不修改用户配置，只做运维操作”，但 L073 将“配置变更记录”作为日志归档对象，表明该技能会处理与配置变更相关的内容。虽然这里未明确执行配置修改，但文档一方面强调不涉及用户配置，另一方面又纳入配置变更相关运维事项，意图边界表达不一致。
- Content
Static analysis
No suspicious patterns detected.