T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:160- Finding
Untrusted Learnings Can Be Promoted into Persistent Agent Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Self Improving Agent 1.0.1
Security checks for vulnerabilities and agentic risk
Overview
This skill is not malicious, but it encourages broad automatic logging and promotion of user or tool-derived information into persistent agent memory without enough sensitivity review or user control.
Install only if you are comfortable with agents keeping a durable learning log. Keep .learnings local or gitignored for sensitive projects, avoid global hooks, use scoped matchers, and require explicit review before any learning is added to CLAUDE.md, AGENTS.md, or Copilot instructions. Do not log raw errors, credentials, customer data, private prompts, or proprietary snippets without sanitizing them first.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description is about maintaining and consulting a repository of learnings after failures, corrections, missing capabilities, or outdated knowledge. The supplied code does not implement learning capture, error/correction logging, retrieval/review of learnings, or trigger-based continuous improvement behavior. Instead, it is a helper script for creating a new skill scaffold on disk from a learning entry name. This is a materially different primary purpose and includes undeclared file-creation capabilities. While the script references learnings conceptually, its actual function is skill extraction/scaffolding, not capturing or reviewing learnings as described.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The templates explicitly request 'full context,' inputs, parameters, and actual error output, which commonly contain secrets, access tokens, file paths, customer data, stack traces, or proprietary code fragments. Because the format encourages verbatim persistence, it materially increases the chance of sensitive-data capture and later disclosure through shared repos, backups, or downstream agents.
- Content
Agent Config Directory Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Instructing users to place executable hook configuration in ~/.claude/settings.json grants persistent behavior from a high-trust agent configuration directory. If the referenced scripts are modified, replaced, or insufficiently audited, the effect applies across all future sessions and projects, amplifying the blast radius.
- Content
Option 2: User-Level Configuration
Add to
~/.claude/settings.jsonfor global activation:json {
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill's core workflow is to automatically persist corrections, requests, failures, and contextual details into markdown files. That creates a durable natural-language audit trail of user-provided and system-derived data, which may exceed user expectations and can expose sensitive information to later agents, developers, or source control.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill tells agents to record detailed error and context information, but gives no instruction to scrub secrets, credentials, tokens, personal data, or proprietary inputs before writing them to disk. Error output and user context often contain exactly that kind of sensitive material, so this creates a realistic data-retention and leakage path.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Promoting learnings into CLAUDE.md, AGENTS.md, or Copilot instructions broadens the audience and lifetime of captured information. Without an explicit sensitivity review, user-derived details, internal architecture notes, credentials, or confidential operational mistakes can be propagated into durable shared guidance.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Automatically logging whenever the user provides information the agent did not know creates a broad retention trigger untethered to sensitivity. In practice, that can capture private business context, credentials, unpublished implementation details, or personal information simply because it was novel to the agent.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
When the above learning is extracted as a skill, it becomes:
File:
skills/docker-m1-fixes/SKILL.mdmarkdown ---
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 84% confidence
- Finding
The guide establishes persistent hook-based behavior via agent settings, causing automatic execution to recur across future prompts and sessions. Persistence is risky in agent environments because unsafe or overly broad automation can continue silently after the original setup context is forgotten.
- Content
Option 1: Project-Level Configuration
Create
.claude/settings.jsonin your project root:json {
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
An empty matcher causes the UserPromptSubmit hook to fire on every prompt, creating overly broad and persistent execution of the configured script. In an agent environment, broad trigger scope increases exposure to prompt-driven abuse, unnecessary data processing, and user desensitization to automatic behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The user-level configuration enables the hook globally from the agent config directory while still using an unrestricted matcher. That combination expands the hook's reach across all sessions and repositories, making any unsafe script behavior or prompt-triggered side effect much more pervasive.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The minimal setup still triggers on every prompt because the matcher is empty, so it does not actually reduce execution scope—only the number of hook types. This broad activation can still cause unnecessary script execution and increase the attack surface for agent-side automation abuse.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The Codex example repeats the same overly broad empty matcher pattern, which may be copied directly by users into another agent ecosystem. Recommending unrestricted triggers without scope limits increases the likelihood of widespread unnecessary execution and unsafe normalization of always-on hooks.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The document claims the hook scripts only output text and do not run commands, yet the setup explicitly configures them as shell commands executed by the agent framework. This mismatch can mislead users into granting trust or permissions they would not otherwise allow, increasing the risk of unintended code execution or unsafe review of the referenced scripts.
- Content
Static analysis
No suspicious patterns detected.