T01 · Skill Instruction Hijacking
Error
- Location
references/AGENTS-template.md:8- Finding
Persistent Agent Instruction and Memory Hijacking Through Automatically Loaded Workspace Files
- Content
View full analysis
- Remediation
View remediation
Security audit
Shang Tsung
Security checks for vulnerabilities and agentic risk
Overview
This is a local agent-memory skill, but it gives persistent workspace files influence over future agent behavior and needs careful review before installation.
Install only in a dedicated, private workspace where the memory files are agent-owned and expected to persist. Review and prune MEMORY.md, PROOF_OF_LIFE.md, daily logs, and soul files regularly; do not store secrets there; treat remembered text as notes rather than commands; avoid untrusted writers in the workspace; validate AGENT_NAME values; and avoid SOULS_DIR overrides unless you intentionally want writes outside the default workspace path.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/souls-helper.sh:27- Finding
Path Traversal and Symlink Race Permit Soul Files to Be Written Outside the Intended Namespace
- Content
View full analysis
AGENT_NAME > default if [[ -n "${SOULS_DIR:-}" ]]; then : # already set elif [[ -n "${AGENT_NAME:-}" ]]; then SOULS_DIR="$WORKSPACE/souls/$AGENT_NAME" else SOULS_DIR="$WORKSPACE/souls" fi # Ensure souls directory exists if [[ ! -d "$SOULS_DIR" ]]; then mkdir -p "$SOULS_DIR" fi SOULS_DIR="$(cd "$SOULS_DIR" && pwd)" ``` ```bash cmd_create() { local next next=$(next_filename) local num num=$(compute_next_number) local path="$SOULS_DIR/$next" if [[ -f "$path" ]]; then echo "ERROR: $path already exists. Aborting." >&2 exit 1 fi soul_template "$num" > "$path" local dir_display dir_display=$(echo "$SOULS_DIR" | sed "s|$WORKSPACE/||") echo "created: $dir_display/$next" echo "rule: this file is your current soul, not inherited lineage" } ``` ### Technical Analysis `AGENT_NAME` is directly concatenated into the output directory without validation. A value containing path separators or `..` components can escape `$WORKSPACE/souls`. The later `cd` and `pwd` canonicalize the resulting path, but the script never verifies that the canonical path remains inside the intended directory. `SOULS_DIR` intentionally supports a full-path override, but it is accepted from the environment without any trust or containment check. If environment variables can be influenced by an untrusted launcher or task, file creation can be redirected to an arbitrary writable directory. The `cmd_create` function separately checks whether the target is a regular file and then opens it using shell redirection. This is a check-to-time-of-use race: 1. The existence check and file opening are separate operations. 2. An attacker with write access to the ...[truncated 2153 chars]- Remediation
View remediation
&2 exit 1 fi ``` 2. Canonicalize the intended base directory and reject derived paths that are not descendants of it. 3. Treat `SOULS_DIR` as a privileged configuration option. Reject external paths by default or require an explicit unsafe-override flag. 4. Verify that every directory component is owned by the expected user and is not writable by untrusted users. 5. Reject symbolic links for both the souls directory and destination file. 6. Replace the check-then-write sequence with atomic exclusive creation. Use a mechanism that fails if the destination already exists and does not follow symlinks. 7. Create a temporary file securely in the same directory, apply restrictive permissions, and atomically rename it only after validating the destination. 8. Set a restrictive process umask before creating directories or records: ```bash umask 077 ``` 9. Add tests covering traversal strings, absolute paths, dangling symlinks, symlink races, and cross-Agent namespace access. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The script is consistent with part of the description: it is pure bash, uses markdown files, has no network behavior, and supports multi-agent namespacing via AGENT_NAME/SOULS_DIR. However, the declared purpose claims a broader memory system that combines Second Brain artifacts (PROOF_OF_LIFE, daily logs, MEMORY.md) with SOULS lineage. This code chunk only manages SOULS session files: status, creation from template, template output, and integrity verification of numbering/readability. It does not implement the Second Brain features, nor does it ingest prior session content beyond identifying the previous numbered file. Therefore the description materially overstates what this supplied code chunk actually does.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Copy `scripts/souls-helper.sh` into your workspace at `tools/souls-helper.sh`:
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Copy `scripts/souls-helper.sh` into your workspace at `tools/souls-helper.sh`:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README promotes persistent storage of agent state, identity, and session memory across restarts, but it does not prominently warn that these files may accumulate sensitive user prompts, decisions, or other private context over time. In an agent-memory skill, silent persistence changes the data-retention model and can lead to unintended disclosure in shared workspaces, backups, or later sessions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The documented workflow instructs the agent to overwrite and append to fixed workspace files like PROOF_OF_LIFE.md and memory logs without a strong warning that existing files will be modified. In a shared or pre-populated workspace, this can cause unintended alteration of user data, persistence of sensitive context, or confusion about what content is agent-authored versus user-authored.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to overwrite and append persistent workspace files, including PROOF_OF_LIFE.md and dated logs, without explicit safeguards, scoping checks, backup guidance, or user-consent warnings. In shared or misconfigured workspaces, this can cause unintended data loss, cross-agent contamination, or modification of user-maintained files, especially because the workflow promotes automatic execution at each session and before restart.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The template instructs the agent to load and persist personal context from MEMORY.md and daily logs, but it does not require any explicit user consent, retention disclosure, minimization, or deletion policy. Although it mentions a privacy boundary for group chats, the skill is specifically designed for persistence and identity continuity, which increases the chance of collecting and retaining sensitive personal data across sessions without clear user awareness.
- Content