Security audit

Heleni Memory Architecture

Security checks for vulnerabilities and agentic risk

Overview

This memory skill is mostly transparent about its purpose, but it asks for persistent self-review jobs, instruction-file edits, and Git pushes without enough user control.

Install only if you intentionally want an agent to maintain persistent memory and you are prepared to review what it writes. Avoid installing the cron jobs as written, do not let it edit AGENTS.md or SKILL.md unattended, confirm any Git destination before pushing memory files, and replace the shell-sourced .context pattern with a data-only configuration format.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:30
Finding: Unverified Behavioral Inferences Are Written to Persistent Agent Memory
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: SKILL.md:134
Finding: Recurring Cron Jobs Create Cross-Session Persistence and Autonomous Self-Modification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:8
Finding: Local Context File Is Executed as Shell Code Without Validation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:205
Finding: Memory and Agent Configuration May Be Pushed to Git Without Destination or Content Validation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Context Leakage

High

Category: Data Exfiltration
Confidence: 75% confidence
Finding: The skill is explicitly designed to capture context before it disappears and to persist summaries and deductions across files, which creates a real data retention and context leakage risk if sensitive or unnecessary information is stored. The danger is heightened because the trigger conditions are broad and the workflow encourages frequent logging across daily, project, and long-term memory tiers.
Content: Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.
md
--- name: memory-architecture version: "1.0.0" description: "Honcho-inspired memory architecture for PA agents. Use when writing to MEMORY.md, ending a significant conversation, or deciding what to remember long-term. Implements two key patterns: deductive memory (not just facts, but logical conclusions) and session summaries (capture context before it disappears)." --- ## Load Local Context

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 70% confidence
Finding: Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
Content: Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.
md
Examples: - `[DEDUCED] Prefers English for work docs — corrected me when I created Hebrew doc (2026-04-03)` - `[DEDUCED] Expects autonomous execution without asking permission for reversible tasks — never asks why I acted autonomously` - `[DEDUCED] Reads messages outside work hours but won't always respond` ---

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The activation description is broad enough to apply to many normal conversations, increasing the chance that the skill is loaded in contexts where persistent writes are unnecessary. Over-broad triggering raises the risk of oversharing, excessive retention, and accidental execution of the skill’s more invasive actions.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.
md
Examples: - `[DEDUCED] Prefers English for work docs — corrected me when I created Hebrew doc (2026-04-03)` - `[DEDUCED] Expects autonomous execution without asking permission for reversible tasks — never asks why I acted autonomously` - `[DEDUCED] Reads messages outside work hours but won't always respond` ---

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill’s scope expands beyond memory handling into creating cron jobs, updating SKILL.md/AGENTS.md, and committing changes to git. That broadens the agent’s authority from passive note-taking to persistent automation and instruction modification, which can cause unintended system behavior or durable prompt drift if triggered in routine use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs autonomous file modifications, cron creation, and git commits/pushes without requiring a visible warning or approval step. Persistent changes plus scheduled autonomous execution materially increase risk because mistakes or adversarially-induced edits continue after the original session ends.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Documenting maintenance of AGENTS.md and other instruction files under a memory skill creates instruction-surface sprawl and enables a memory workflow to rewrite higher-priority behavioral guidance. This is dangerous because it can silently alter future agent behavior beyond the user’s immediate intent and make compromise or accidental drift persistent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The example '[DEDUCED] Prefers English for work docs' records a language preference as a persistent rule, but the skill does not state that language choice should remain user-driven or explicitly confirmed before being enforced broadly. This can lead to a language/locale policy issue if the preference is applied by default without opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.