Security audit

Agent Memory Architecture

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent memory system, but it asks agents and sub-agents to persist and broadly reuse potentially sensitive personal and infrastructure context without enough scoping or consent controls.

Install only if you are comfortable maintaining local persistent agent memory. Do not put passwords, tokens, private keys, recovery codes, or sensitive credential paths in these files. Before using it with sub-agents, cron jobs, public posting, shared workspaces, or third-party tools, narrow what each agent can read and write, and keep backups or an append-only audit trail for memory changes.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:155
Finding: Mandatory Full-Memory Loading Exposes Sensitive Context to Sub-Agents
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · templates/platform-posts.md (reported line 3)May include surrounding context.
md
# [Platform Name] Posts

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · templates/platform-posts.md (reported line 4)May include surrounding context.
md
# [Platform Name] Posts    ## [YYYY-MM-DD HH:MM] Example Post Title

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · templates/platform-posts.md (reported line 5)May include surrounding context.
md
   ## [YYYY-MM-DD HH:MM] Example Post Title - **Posted:** YYYY-MM-DD HH:MM AM/PM EST

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill is framed as a universal memory architecture for AI agents and lacks explicit activation boundaries, approval requirements, or environment constraints. That broad scope increases the chance an agent will apply persistent memory behaviors in contexts where storage, retrieval, or cross-session continuity was not intended, leading to privacy and governance issues.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs agents to create, update, and clear persistent memory files, including inbox processing that deletes processed entries, without requiring user-visible notice or confirmation. This can cause silent retention, modification, or destruction of potentially sensitive user data and makes auditability harder if information is overwritten or cleared automatically.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The sub-agent template directs every spawned sub-agent to read MEMORY.md and recent daily logs, which the skill itself says may contain operator preferences, infrastructure details, and personal context. Without strict scoping, minimization, and explicit warnings, this creates unnecessary propagation of sensitive data across isolated sessions and increases the risk of privacy leakage or overexposure to tools and contexts that do not need it.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The template explicitly prompts the agent/operator to record 'credentials locations' in long-term memory, but provides no warning, minimization guidance, or restrictions on handling secrets. In a memory system designed for persistence across sessions, this increases the chance that sensitive authentication material or directions to retrieve it will be stored in broadly accessible context, leaked to sub-agents, exposed in logs, or surfaced to unintended users.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The markdown template specifies the posting timestamp as 'AM/PM EST', which imposes a specific locale/timezone format in natural language. This can violate language/locale policy expectations because the file does not provide an opt-in, alternative timezone handling, or justification for why EST is required.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.