T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:76- Finding
Automatic Persistent Storage of Untrusted Personal Conversation Data
- Content
View full analysis
- Remediation
View remediation
Security audit
Memory Extraction
Security checks for vulnerabilities and agentic risk
Overview
This skill is openly a memory tool, but it tells the agent to automatically store broad personal details from conversations without clear consent, review, deletion, or retention controls.
Install only if you want an agent to maintain persistent conversation memory. Before using it with real users or sensitive work, add explicit opt-in, preview/confirmation before memory writes, sensitive-data exclusions, provenance, and a clear way to inspect and delete stored records.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The system-prompt guidance instructs the agent to proactively collect and record broad categories of sensitive profile data, including age, gender, location, occupation, education, goals, and relationships, without any accompanying privacy notice, minimization rule, or consent requirement. This creates a high risk of covert profiling and persistent retention of sensitive personal data beyond what is necessary for the conversation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly describes automatic extraction of entities, relationships, and observations from conversation and writing them into persistent knowledge-graph storage, but it provides no user-facing notice or consent mechanism. Because the documented memory categories include personal and profile data, users may unknowingly disclose sensitive information that is retained beyond the session.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The examples encourage storing sensitive atomic observations such as email addresses directly in persistent memory. Even as examples, they normalize retention of contact data without masking, minimization, or consent, which increases the risk of privacy violations, unintended disclosure, and secondary misuse.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill directs the agent to proactively persist broad personal data categories into memory, including identity, behaviors, preferences, goals, and relationship data. In context, this is more dangerous because the storage is persistent and integrated into normal conversation flow, making silent long-term profiling likely unless strong controls exist elsewhere.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The system prompt integration instructs the agent to say "正在回忆..." at the start of each conversation, which imposes a specific language output. The file does not indicate that the skill is limited to Chinese-language use cases or that the user can choose their preferred language.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest description is written entirely in Chinese and does not indicate that the skill supports multiple languages or that Chinese is a required locale for a region-specific use case. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Static analysis
No suspicious patterns detected.