Agent Memory Ops

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:19 AM UTC
• Version: 0.1.1

Overview

This skill is a coherent local memory-audit helper, but its reports can print memory note contents, so users should treat output as private.

Install only if you are comfortable with a local tool reading MEMORY.md and memory/*.md and printing selected note contents. Keep markdown or JSON reports out of public logs and shared automation unless you have reviewed them for secrets or personal information.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/memory_ops.py:218

Finding

Secret Filtering Is Not Applied to Report and Deduplication Outputs

Content

View full analysis

Vulnerability Details

File Location: scripts/memory_ops.py:163-164, scripts/memory_ops.py:218-220, scripts/memory_ops.py:253-260, and scripts/memory_ops.py:284-289
Vulnerability Type: Sensitive information exposure through inconsistent output filtering
Risk Level: Medium

The digest operation excludes items identified as secrets:

python

for item in items:
    if is_secret(item.text):
        continue

However, the Markdown report emits duplicate and TODO text without applying the same filter:

python

if todos:
    lines += ["", "## Follow-up candidates"]
    for item in todos[:15]:
        lines.append(f"- `{Path(item.file).name}#{item.line_no}` — {item.text}")

The JSON report also returns raw duplicate and TODO text:

python

if args.format == "json":
    json_dump(
        {
            "root": str(root),
            "memory_exists": memory_md.exists(),
            "daily_files": len(daily_files),
            "items": len(items),
            "duplicate_clusters": [
                [{"file": x.file, "line": x.line_no, "text": x.text} for x in c] for c in dupes
            ],
            "todos": [{"file": x.file, "line": x.line_no, "text": x.text} for x in todos],
        }
    )

The deduplication command similarly emits unredacted text in both JSON and Markdown:

python

if args.format == "json":
    json_dump([[{"file": x.file, "line": x.line_no, "text": x.text} for x in c] for c in dupes])
    return
if not dupes:
    print("No duplicate clusters found.")
    return
for idx, cluster in enumerate(dupes, start=1):
    print(f"## Cluster {idx}")
    for item in cluster:
        print(f"- {Path(item.file).name}#{item.line_no}: {item.text}")

Technical Analysis

Secret handling is implemented only in classify_digest(). The report and dedupe paths process the same potentially sensitive memory content but pass e ...[truncated 2223 chars]

Remediation

View remediation

Remediation Suggestions

1. Introduce a centralized output-sanitization function and apply it to every memory-derived text field before Markdown or JSON serialization.
2. Replace detected secret values with a fixed marker such as [REDACTED] rather than merely omitting selected records.
3. Apply sanitization consistently to duplicate clusters, TODO candidates, digest candidates, and all future output formats.
4. Expand detection to cover private-key blocks, cloud access keys, database connection strings, authentication cookies, JWTs, webhook secrets, and other commonly used credential formats.
5. Consider using entropy-based detection or a maintained secret-scanning library in addition to regular expressions.
6. If raw output is operationally necessary, require an explicit opt-in option with a prominent warning; secure output should remain the default.
7. Add regression tests containing representative synthetic secrets in TODO and duplicate bullets, verifying that neither Markdown nor JSON contains the original values.
8. Document that generated reports may contain memory-derived data and should not be published or retained in broadly accessible logs.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The listed good use cases are exclusively written in Chinese, which signals a language-specific invocation pattern without documenting that the skill supports other languages or letting the user choose. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code emits raw bullet text from MEMORY.md and daily memory files to stdout in both markdown and JSON modes. Although it filters obvious secrets in one digest path, the report and dedupe commands still disclose note contents and there is no warning, confirmation, or user-facing disclosure about exposing potentially sensitive memory data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The dedupe path outputs full text for near-duplicate memory bullets directly to stdout or JSON. This is a privacy-relevant operation because local notes may contain personal or sensitive information, yet the command includes no warning, prompt, or explanatory comment indicating that such data will be revealed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.