ClawHub
Back to skill

Security audit

mupengism

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed file-memory framework, but it encourages persistent, self-modifying agent identity and memory without enough control over what gets stored or later trusted.

Install only if you intentionally want a workspace-level persistent memory system. Keep SOUL.md and AGENTS.md under human review, do not let routine sessions rewrite identity or tool guidance automatically, avoid storing secrets or sensitive personal data, and periodically delete or prune memory files.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:23
Finding

Persistent Agent Instruction Hijacking Through Self-Modifying Identity and Memory Files

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:23-29, SKILL.md:142-150, SOUL-TEMPLATE.md:4, SOUL-TEMPLATE.md:63-65, SOUL-TEMPLATE.md:96-99, MEMORY-SYSTEM.md:28-56, MEMORY-SYSTEM.md:170-176, MEMORY-SYSTEM.md:194-196
Vulnerability Type: Persistent instruction hijacking and agent memory poisoning
Risk Level: High

Vulnerable Snippets

SKILL.md:23-29:

markdown
## Installation

To use this skill:

1. Copy `SOUL-TEMPLATE.md` to workspace as `SOUL.md`
2. Customize content for your agent
3. Create `memory/` folder
4. Configure AGENTS.md to load SOUL.md every session

SKILL.md:142-150:

markdown
### Self-Reflection Loop

heartbeat → self-check → update SOUL.md if needed ↓ Accumulate insights in MEMORY.md ↓ Discover patterns → improve behavior

text

The associated template directs the agent to read SOUL.md at every session start, gives it fixed economic priorities, and directs discovered patterns and methods to be written into SOUL.md or TOOLS.md. The memory guide similarly requires session-start loading of identity and context files and promotes raw daily records through weekly and long-term memory into SOUL.md.

Technical Analysis

The installation procedure places SOUL.md in the agent workspace and directs the operator to modify AGENTS.md so that the file is loaded during every session. This turns content in SOUL.md from passive documentation into persistent behavioral instructions.

The self-reflection workflow compounds this risk by directing the agent to:

  1. Collect session observations in daily memory files.
  2. Promote selected content into weekly and long-term memory.
  3. Incorporate fundamental patterns into SOUL.md.
  4. Reload the resulting identity instructions in subsequent sessions.
  5. Potentially update TOOLS.md, another file capable of influencing future tool behavior.

No provenance enforcement, trusted-content boundary, approval gate, saniti ...[truncated 2587 chars]

Remediation
View remediation

Remediation Suggestions

  1. Do not configure AGENTS.md to load mutable memory or identity files as authoritative instructions.
  2. Treat SOUL.md, SELF.md, MEMORY.md, and files under memory/ as untrusted reference data rather than governing policy.
  3. Separate immutable, administrator-approved policy from user-generated and session-generated memory.
  4. Prohibit autonomous modification of AGENTS.md, SOUL.md, and TOOLS.md.
  5. Require explicit, informed user approval for every proposed change to persistent behavioral policy.
  6. Add provenance metadata to each memory entry, including its source session, author, creation time, and approval status.
  7. Sanitize and classify content before promoting it between memory tiers. Reject embedded instructions, role changes, safety-policy modifications, and tool directives.
  8. Use an allowlist of fields that may be persisted, such as factual project state, while excluding goals, credentials, identity rules, and executable instructions.
  9. Apply filesystem permissions so routine agent operations cannot overwrite policy or tool-configuration files.
  10. Add version control, integrity checks, reviewable diffs, and rollback support for all persistent state.
  11. Remove fixed economic and identity priorities from the reusable template, or clearly mark them as optional examples that cannot supersede active user instructions or higher-level safety policies.
  12. Ensure memory retrieval presents stored content as quoted historical data and never as instructions to execute.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
71% confidence
Finding

The file is written as a Korean-directed skill artifact and frames the system identity and operating instructions in Korean without indicating that users may choose another language. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The document explicitly encourages persistent file-based memory across sessions, including daily logs and working context, while only briefly listing examples of data not to store. It does not provide a clear user-facing consent, retention policy, deletion process, or warning that routine activity/context will be durably recorded, which creates privacy and data-retention risk if users share sensitive project or personal details.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The file is written entirely in Korean and its operating principles prohibit common conversational filler while prescribing a specific communication style, but it does not offer any language or locale choice. Because SQP-3 applies to natural-language policy violations in any file type, a skill principle document that effectively fixes interaction to one language without user opt-in can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill mixes a prohibition on unauthorized external actions with guidance to 'solve first and ask later,' which can pressure an agent to take unapproved steps before obtaining consent. In an agent setting, ambiguous priority between speed/autonomy and authorization can lead to policy bypasses, especially for actions with side effects such as messaging, posting, or external API use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The visible instructional content and descriptions are written in Korean, and the file does not indicate that another language is available or that Korean is required for a region-specific purpose. This can violate a language/locale policy when users are not given an opt-in or alternative language path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs users to create persistent identity and memory files and to load them every session, but it provides no safeguards about what kinds of user, session, or secret data may be written there. In practice, this can cause agents or users to persist sensitive personal data, credentials, internal prompts, or other unintended state into workspace files that survive across sessions and may later be exposed, misused, or blindly trusted.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The self-reflection loop tells the agent to update SOUL.md and accumulate insights in MEMORY.md, which encourages autonomous writes to core identity and memory files without overwrite protections or validation. This is dangerous because unintended content, prompt injection artifacts, or manipulated session data could be persisted into trusted long-term state and then influence future behavior across sessions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The entire template's operative instructions are written in Korean, including identity, behavior, and policy guidance, with no indication that language choice is optional or user-configurable. This creates a natural-language policy concern because it effectively fixes the skill's language/locale rather than offering opt-in or documenting a justified regional constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.