T02 · Agent Memory Poisoning
Warning
- Location
scripts/learner.py:5- Finding
Unvalidated Cross-Session Memory Can Poison Future Skill Behavior
- Content
View full analysis
- Remediation
View remediation
Security audit
meta-academic-translation
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly an academic-translation helper, but it asks agents to persist user-derived learning and eventually rewrite its own instructions without clear consent or boundaries.
Review this skill before installing. It does not show evidence of exfiltration or malware, but it should not be allowed to automatically rewrite SKILL.md or retain cross-session preferences and notes unless you explicitly want that behavior and can inspect or delete the stored learned_patterns.json file.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill claims advanced self-verification, reflection, orchestration, and continuous evolution capabilities that are not substantiated by the described implementation, while the concrete behavior appears to be simple local statistics/persistence. This is dangerous because inflated capability claims can mislead users and downstream agents into trusting the skill's outputs, guardrails, or autonomy beyond what actually exists.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs the agent to 'write back' accumulated experience into SKILL.md, meaning the skill can modify its own instructions and workflow over time. Self-modifying prompt artifacts are especially risky because they can entrench prompt injection, drift from reviewed behavior, and bypass normal review or change-control processes.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill documents file-writing behavior such as creating output directories, writing self-check artifacts, and persisting learned state, but it does not declare an explicit tool scope or permissions boundary. In an agent environment, undeclared write capability increases the risk of unintended filesystem modification because operators and users cannot easily tell what files the skill may create or alter.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill describes automatic creation of output directories, history files, self-check files, and learned state without clearly warning the user in the main usage path that persistent files will be created or modified. Silent persistence is dangerous because users may unknowingly leave sensitive document traces or preference data on disk.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The persistent learning subsystem stores cross-session usage history, error patterns, and user preferences in a local memory file even though that behavior is not necessary for performing a single academic translation. This expands the data-retention and attack surface of the skill by turning a narrow translation tool into a stateful profiler without clear minimization, consent, or deletion boundaries.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The memory subsystem directs the agent to retain operation counts, capability usage, error patterns, user preferences, and derived insights across sessions, but it does not define minimization, redaction, access control, or retention limits. In a translation context, this can capture sensitive research topics, user habits, or workflow metadata that are unnecessary for the immediate task and persist longer than expected.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The example preference command hardcodes '输出语言=中文' as a remembered user preference without describing opt-in language selection or how such preferences are scoped. While not severe on its own, it can cause unwanted behavior persistence and demonstrates that user preferences may be stored across sessions without clear consent boundaries.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The document is entirely written in Chinese, including the title and all operational descriptions, with no indication that language selection is optional or user-configurable. This can violate a language/locale policy when a skill or its outputs are forced into a specific language without explicit user opt-in or documented regional justification.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest describes a meta-skill with self-verification, self-reflection, super-agent orchestration, and continuous self-evolution. In this file, the implementation only records success/failure counts and optional notes in a local JSON file, which is far narrower than the claimed behavior and does not implement the advanced capabilities described.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The only natural-language description in the file is a Chinese-only module docstring, which indicates the skill is documented in a single language without offering user language choice or stating a justified locale-specific scope. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.
- Content
Static analysis
No suspicious patterns detected.