Security audit

Big Memory

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent memory-recovery tool, but it persists detailed project context automatically and lacks clear safeguards against saving or replaying sensitive or untrusted content.

Review this skill before installing if you work with secrets, private customer data, proprietary code, or regulated information. Use only explicit save and recall commands where possible, avoid automatic compaction capture until redaction rules are added, and do not enable session transcript indexing or cloud embeddings unless you are comfortable making that content searchable or provider-processed.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:130
Finding: Durable snapshots can preserve and reactivate attacker-controlled instructions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:130-158`, with related capture and precedence rules at `SKILL.md:102-107` and `SKILL.md:217-220` **Vulnerability Type**: Persistent memory poisoning through untrusted snapshot content **Risk Level**: Medium ### Vulnerable Code ```markdown ### Step 2: Search for Latest Snapshot Execute this search: ``` memory_search("BIG-MEMORY-SNAPSHOT") ``` This triggers hybrid vector + BM25 search across all memory files. The HTML comment markers ensure high BM25 relevance scoring. If results are found, use `memory_get` or `Read` to retrieve the full file content at the matched path and line range. If no results from the primary search, try broader queries: ``` memory_search("SNAPSHOT Active Goal Next Steps") memory_search("{today's date} task snapshot") ``` ### Step 3: Inject and Orient After retrieving a snapshot: 1. Parse the content between `` and `` markers 2. Inform the user: "I detected context was compacted. Restoring task state from snapshot taken at {timestamp}..." 3. Present the recovered state concisely: - **Goal:** {from Active Goal} - **Phase:** {from Current State} - **Working on:** {from Files In Play} - **Next up:** {from Next Steps} 4. Ask: "Does this match where we left off? Anything to update before I continue?" 5. Resume work from the Next Steps section ``` The associated precedence rule states: ```markdown - **Latest snapshot wins.** When multiple snapshots exist, the most recent one is the source of truth. Earlier snapshots provide history but should not override later decisions. ``` ### Technical Analysis The skill creates snapshots from current task and conversation state, including free-form decisions, code context, blockers, and next steps. Such task material may originate from untrusted documents, repository content, or other attacker-controlled inputs. During recovery, the skill retrieves the latest s ...[truncated 2176 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat every recovered snapshot field as untrusted data rather than executable instructions. 2. Store snapshots in a typed structure with strict field validation instead of unrestricted Markdown. 3. Escape or reject snapshot delimiter strings appearing inside captured content to prevent structural injection. 4. Record provenance for every item, including whether it came from the user, repository content, tool output, or the agent's own verified decision. 5. Never designate the newest snapshot as authoritative solely based on timestamp; add integrity protection and task/session binding. 6. Present recovered actions to the user and require explicit approval before executing them. 7. Reject imperative instructions copied from untrusted files or tool output unless the user independently confirms them. 8. Apply an allowlist to `Next Steps`, restricting them to descriptive task operations and excluding requests to alter safety rules, access unrelated data, or invoke unrelated tools. 9. Add cryptographic integrity protection or trusted metadata so externally edited memory files cannot silently become authoritative. 10. Provide a recovery mode that summarizes the snapshot without automatically resuming its instructions. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:115
Finding: Sensitive task context is persisted in plaintext without redaction or retention controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:115-126`, with sensitive-field definitions at `SKILL.md:29-70` and `references/TASK-SNAPSHOT.md:22-54` **Vulnerability Type**: Insecure plaintext persistence of potentially sensitive task data **Risk Level**: Medium ### Vulnerable Code The storage procedure requires snapshots to be appended to a daily Markdown file: ```markdown ## How to Store Snapshots 1. Read the current daily log `memory/{YYYY-MM-DD}.md` using `Read`. If it does not exist, you will create it. 2. **APPEND** the snapshot. Never overwrite existing content. Read the file first, then use `Edit` to append at the end. Alternatively, use `Write` with the full existing content plus the new snapshot. 3. Precede the snapshot with a horizontal rule and heading: ```markdown --- ## Task Snapshot -- HH:MM  ...  ``` 4. Multiple snapshots in the same file is expected. Each captures a point-in-time state. The most recent snapshot is the source of truth. ``` The required template explicitly requests exact code, identifiers, absolute paths, errors, and configuration values: ```markdown ### [SNAPSHOT] Code Context ```{language} // Only include code that cannot be reconstructed from reading files // Function signatures, error messages, exact patterns, config values // Keep under 50 lines total ``` ### [SNAPSHOT] Key Names & Values - {identifier type}: `{exact value}` - {identifier type}: `{exact value}` ``` ### Technical Analysis The skill deliberately persists broad task context in ordinary Markdown files. Requested snapshot data includes exact code fragments, absolute file paths, API endpoints, environment-variable identifiers, configuration values, error messages, user requirements, and other project-specific information. The design contains no mandatory secret scanning, value redaction, data classification, encryption, restrictive file-permission requirement, retention perio ...[truncated 1991 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Explicitly prohibit storing passwords, API keys, access tokens, private keys, session cookies, connection strings, and personal data. 2. Run secret-detection and sensitive-data redaction before writing every snapshot. 3. Store identifier names when useful, but replace secret values with placeholders such as `[REDACTED]`. 4. Minimize code snippets, absolute paths, stack traces, and configuration values to the least information necessary for recovery. 5. Create memory files with restrictive permissions and verify that the memory directory is not broadly readable. 6. Define a retention period and provide commands to securely delete snapshots by task, date, or session. 7. Support updating or purging superseded sensitive snapshots rather than relying exclusively on append-only storage. 8. Encrypt memory at rest where the platform provides a suitable protected key store. 9. Warn users before indexing session transcripts or using a cloud embedding provider, and document exactly which content may leave the local system. 10. Add configurable exclusion patterns for sensitive paths and file types, including environment files, credential stores, private keys, and production configuration. 11. Perform redaction before local or remote indexing so sensitive plaintext is never sent to an embedding provider. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Hidden Instructions

High

Category: Prompt Injection
Content: Every snapshot MUST follow this exact structure. Do not omit fields -- write "none" if a field is empty. For the full template with field-by-field guidelines, read `{baseDir}/references/TASK-SNAPSHOT.md`. ```markdown
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

Category: Prompt Injection
Content:  ``` The HTML comment markers (`` and ``) are critical. They act as machine-parseable delimiters that `memory_search` matches via BM25 exact-term matching, enabling precise retrieval. ---
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

Category: Prompt Injection
Content:  ...  ``` 4. Multiple snapshots in the same file is expected. Each captures a point-in-time state. The most recent snapshot is the source of truth.
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The skill advertises broad activation phrases such as "checkpoint" and "restore context" at the metadata level, which can cause the skill to trigger in conversations where the user did not intend to invoke durable-memory behavior. Because the skill writes structured task state to memory, unintended activation increases the chance of persisting sensitive project details without clear user consent.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The snapshot schema instructs the agent to store exact code context, identifiers, endpoints, table names, environment variables, errors, file paths, and decisions into long-term memory files. This materially increases the chance of persisting secrets, internal architecture details, or sensitive business logic that may later be exposed through search, recall, or unrelated tasks.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The user-trigger section explicitly treats the vague word "checkpoint" as a command to immediately create a snapshot. In normal developer conversations, "checkpoint" can be used descriptively rather than as consent to persist memory, so this creates a realistic risk of accidental data capture.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The recovery flow directs the agent to search for, retrieve, and display previously stored snapshots back into the conversation. If snapshots contain sensitive code, internal paths, identifiers, or secrets, this mechanism can resurface that data to the wrong context or user, turning storage risk into direct disclosure risk.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The template explicitly asks for exact key names, values, config data, and user-provided requirements, which can cause snapshots to capture secrets, tokens, internal endpoints, or other sensitive operational details. In a memory/recovery skill, this is especially risky because the feature is designed to persist and resurface context, increasing the chance that sensitive data is retained longer than necessary and echoed back later.

Session Persistence

Medium

Category: Rogue Agent
Content: "enabled": true, "softThresholdTokens": 40000, "systemPrompt": "You are capturing structured task state for post-compaction recovery. Follow the BIG-MEMORY-SNAPSHOT schema exactly. Be precise with file paths, variable names, and code snippets. Do not summarize -- capture specifics.", "prompt": "Context compaction is imminent. Create a structured task snapshot following the BIG-MEMORY-SNAPSHOT schema and APPEND it to memory/YYYY-MM-DD.md. Include all sections: active goal, current state, files in play, decisions made, code context (key snippets only), key names/values, blockers, and next steps. Read the existing daily log first and append -- never overwrite existing content. If there is genuinely nothing worth storing, reply NO_FLUSH." } } }
Confidence: 88% confidence
Finding: The recommended compaction prompt instructs the agent to append structured snapshots containing exact file paths, variable names, code snippets, and key names/values into persistent memory files. This creates durable storage of potentially sensitive implementation details and secrets, and the append-only daily log pattern can accumulate high-value data over time, making accidental disclosure or later retrieval misuse more likely.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The document recommends enabling session transcript indexing and adding `sessions` as a memory source, but it does not warn that past conversation content may contain sensitive data, secrets, personal information, or user-provided confidential material. In a memory/search feature, indexing transcripts expands the persistence and discoverability of prior chat content, increasing privacy and data-retention risk even if no external service is used.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The template instructs use of absolute file paths, which can disclose usernames, home directory structures, repository locations, mount points, or organization-specific environment details. While lower severity than secret capture, this still increases environmental exposure and can aid reconnaissance or leak private workstation/server information when snapshots are shared or persisted.

Static analysis

No suspicious patterns detected.