T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:15- Finding
Persistent Modification of Agent Memory, Identity, and User State
- Content
View full analysis
- Remediation
View remediation
Security audit
Self-Learning for Noktasist
Security checks for vulnerabilities and agentic risk
Overview
This self-learning skill is not overtly malicious, but it asks the agent to persist broad memory, user, identity, logs, and repository changes without clear consent or scope limits.
Review this skill carefully before installing. It is best treated as a Review item unless revised to require explicit user approval before writing long-term memory, USER.md, IDENTITY.md, SOUL.md, logs, configs, or git commits, and to prohibit storing secrets, personal data, raw logs, and unrelated files.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:54- Finding
Standing Instructions Expand Agent Goals Beyond the Active User Task
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:43- Finding
Unrestricted Git Staging Can Commit Sensitive or Unrelated Workspace Files
- Content
View full analysis
- Remediation
View remediation
other
Warning
- Location
SKILL.md:67- Finding
Broad Log and Configuration Inspection May Expose Sensitive Operational Data
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The table explicitly directs storing 'Kullanıcı bilgisi' in USER.md with no disclosure, consent, retention limit, or sensitivity guardrails. That is a direct privacy-risk pattern because it normalizes persistent collection of user information regardless of whether it is necessary for the current task.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill instructs the agent to write discovered configuration and experiences into persistent memory files as part of normal operation, but provides no guidance about privacy, sensitivity, or minimization. This encourages retention of potentially secret or personal information gathered during exploration, increasing disclosure risk over time.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly tells the agent to execute commands ('exec ile kontrol') and inspect logs as part of routine self-learning, expanding its behavior from passive guidance into system interaction. In a self-learning skill, this broadens privileges and can lead to unnecessary command execution, exposure of sensitive operational data, or unsafe actions on the host.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill mandates updating persistent files such as MEMORY.md, IDENTITY.md, SOUL.md, and USER.md after broad categories of 'learning' without narrow justification or approval boundaries. This creates an avenue for unauthorized persistence, profile drift, and storage of sensitive or manipulative state that can influence future agent behavior.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Persistently recording user information in memory files creates a durable natural-language data retention risk: sensitive details can later be surfaced, reused out of context, or leaked through logs, prompts, or repository history. Because the instruction is unconditional, the self-learning context makes over-collection more likely rather than less.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The prescribed git workflow requires committing all meaningful changes, creating durable repository history from the agent's autonomous learning activities. This can persist accidental sensitive data, operational discoveries, or unsafe edits and makes rollback and review harder if commits are routine rather than explicitly approved.
- Content
Static analysis
No suspicious patterns detected.