T02 · Agent Memory Poisoning
Warning
- Location
extract_style.md:87- Finding
Untrusted Document-Derived Content Can Be Persisted in Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
Style Learner
Security checks for vulnerabilities and agentic risk
Overview
This is a small markdown-only writing-style helper whose document reading and style-profile storage are disclosed and aligned with its purpose.
Before installing, decide whether you want extracted writing traits stored persistently. Review profiles before saving them, keep personal MEMORY.md storage separate from any shared knowledge base, and avoid using confidential documents unless the resulting style profile may be retained or shared.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README explicitly states that extracted writing styles are saved to MEMORY.md or a shared knowledge base, but it does not mention consent, sensitivity review, retention limits, or access controls. Because style extraction can preserve distinctive vocabulary, structure, and collaboration patterns from internal documents, this can leak private or organization-sensitive information into persistent storage or broader team-visible repositories.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly states it can save extracted style guides to MEMORY.md or another location, but it does not disclose write-side effects, obtain user confirmation before persistence, or constrain where data may be written. This creates a real risk of unintended data retention, overwriting files, or persisting potentially sensitive derived content from user-provided documents without clear consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill instructs saving extracted style profiles to MEMORY.md or a team knowledge base without any consent, retention, access-control, or sensitivity guidance. Because the input documents may come from Feishu or other sources and can contain identifying, proprietary, or otherwise sensitive writing patterns, this creates a real privacy and data-governance risk through unintended persistence and sharing.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The README includes examples centered on Feishu wiki documents and Chinese vocabulary such as "赋能", "闭环", and "承接", which suggests a specific language/locale orientation. The file does not explicitly state that language is user-selectable or that the skill is limited to a Chinese-language environment.
- Content