memory-first-historical-evidence-review

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:29 AM UTC
• Version: 1.0.0

Overview

This skill is a narrow historical-debugging workflow that tells the agent to use memory first and only consult raw session logs for specific evidence gaps.

Install this only where the agent is allowed to review the relevant historical memory and session logs. In shared or multi-user environments, ensure access is limited to the current user's authorized records and redact secrets or unrelated prior-session content before quoting evidence.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:7

Finding

Unrestricted Historical Memory and Raw Session Log Access

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 7-14
Vulnerability Type: Unauthorized access to potentially sensitive historical agent data
Risk Level: Medium

Relevant Snippet:

markdown

Use when answering questions about what earlier runs established, especially incident causality across multiple dates.

1. Start with dated memory or other curated summaries for the suspected dates.
2. Extract a provisional timeline: symptom, verified config/state, observed fallback/path, working explanation.
3. Note which claims are still unsupported or ambiguous.
4. Search raw session logs only for those gaps.
5. Narrow raw-log lookup by known date, session id, or exact phrase from memory. Avoid wide scans across all archives first.
6. If a raw log is noisy or truncated, reduce scope again instead of broadening the search.
7. Answer from the converged evidence. Separate verified cause from likely cause.

Technical Analysis

The skill instructs the agent to inspect dated memory, curated summaries, and raw session logs. These sources can contain sensitive information from previous sessions, including user prompts, system details, file paths, credentials, tokens, incident records, or data belonging to other users or tenants.

The instructions narrow searches by date, session identifier, or phrase, but they do not require the agent to verify that the current user is authorized to access the selected historical records. They also lack tenant isolation, path restrictions, secret redaction, data-minimization requirements, and an explicit prohibition against exposing unrelated session content.

Consequently, loading this skill could direct an agent with broad filesystem or memory access to cross a least-privilege boundary. The issue does not itself provide elevated operating-system privileges, but it can misuse permissions already granted to the agent to access historical information beyond the legitimate scope ...[truncated 1594 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user authorization before accessing any historical memory or raw session log.
2. Restrict searches to records owned by the current user, tenant, workspace, and authorized task context.
3. Use an allowlisted archive interface instead of unrestricted filesystem or memory searches.
4. Require the user to identify the permitted date range and session identifiers; reject requests targeting records outside that scope.
5. Apply secret detection and redaction before historical excerpts are returned.
6. Return only the minimum evidence needed to answer the question, rather than complete memory entries or raw log sections.
7. Add an explicit rule prohibiting access to unrelated users' sessions, system prompts, credentials, authentication tokens, and private agent state.
8. Record auditable metadata for each historical-data access, including requester identity, authorized scope, accessed records, and redactions.
9. If authorization cannot be established, stop the review and request user-provided, sanitized artifacts instead.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep