T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:44- Finding
Persistent Router Signal Poisoning Through User-Controlled Updates
- Content
View full analysis
- Remediation
View remediation
Security audit
Ai Cgo
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent AI growth-advice assistant, but it asks agents to persist user-derived business learnings into active skill files without enough containment or validation.
Install only if you are comfortable with this skill retaining growth context and potentially updating its own local learning/router files. Avoid sharing proprietary metrics or customer-specific strategy unless the runtime clearly asks before saving and lets you review, edit, or roll back saved entries.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest description includes secondary trigger phrases such as "增长策略" and "怎么用AI赚钱" that are semantically broad and likely to overlap with many unrelated conversations. Because manifest triggers influence invocation before deeper validation, this can cause accidental skill selection and expose users to unintended workflow, memory, and logging behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The routing table uses broad English phrases like "build," "design," "improve," and "optimize," which are common in ordinary requests and can cause the skill to activate outside its intended scope. Over-broad activation can misroute users into a growth-planning workflow, causing unintended data collection and business advice in contexts where the user did not ask for this skill.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The session memory design instructs retention of detailed business context across turns, including industry, stage, budget, CAC, LTV, prior outputs, assumptions, and user satisfaction. This creates a broad aggregation surface for potentially sensitive commercial data, increasing the risk of over-collection, unintended persistence, and later reuse beyond the immediate user request.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The optimization protocol directs the system to write conversation-derived information into knowledge files such as kb.md and router-signals.md, including decision patterns, industry data, failure modes, and assumptions. Even though some lines say user confirmation is needed, the skill is explicitly designed to convert user interactions into persistent artifacts, creating a meaningful risk of retaining proprietary business intelligence or sensitive operational details.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The file content is written entirely in Chinese and does not indicate that language selection is optional or user-configurable. This can violate language or locale policy when users have not opted into that language.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The routing table uses broad, common phrases such as "improve," "build," and "what should we do," which can match many ordinary user requests outside the intended growth-strategy scope. In a router-driven skill system, this can cause unintended activation, misroute users into this skill, and let this skill influence responses in contexts where it should not be selected.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The default rule routes any mix of multiple signals to Diagnoser at a lower threshold without defining clear activation boundaries or precedence rules. This makes the router easier to trigger accidentally and can override more precise routing logic, increasing the chance of inappropriate skill selection and confusing or unsafe downstream behavior.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file contains user-facing natural-language guidance exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into this locale. That creates a potential language/locale policy issue under the rule for forced language without user choice.
- Content
Static analysis
No suspicious patterns detected.