T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:61- Finding
Untrusted Persistent Learning Data Can Influence Future Agent Behavior
- Content
View full analysis
- Remediation
View remediation
Security audit
open-ended-curriculum
Security checks for vulnerabilities and agentic risk
Overview
The skill mainly generates curriculum challenges, but it also stores user preferences and usage history and tells agents to write lessons back into its own instructions, which needs review before installation.
Install only if you are comfortable with the skill keeping a local history of use, errors, notes, and preferences. Before use, remove or disable the learner workflow unless you explicitly want persistent memory, and do not allow automatic updates to SKILL.md from learned records without human review.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (24)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill presents itself as a curriculum/challenge generator, but the documented behavior extends into persistent logging, preference storage, failure tracking, and reflective rewriting of skill state. This mismatch is dangerous because users and orchestrators may invoke it under a benign mental model while it performs additional stateful actions that affect privacy, trust, and future behavior.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest describes a meta-skill for autonomous challenge generation and curriculum escalation, yet the module docstring and implemented functions are a generic learning/telemetry component that records operations, preferences, and simple reflection suggestions. No code here creates tasks, increases difficulty, or manages a non-repeating curriculum, so the actual behavior materially differs from the advertised purpose.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill documents code paths that write persistent state (
learned_patterns.json) but declares no explicit tool scope or permission boundary. That creates an authorization/expectation gap: an agent or reviewer may treat the skill as harmless curriculum generation while it can also modify local files and retain data across runs.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation phrase is broad and ambiguous, covering concepts like unlimited curriculum, self-training, and pushing capability boundaries. Overbroad triggers increase the chance the skill is invoked in contexts where users did not intend persistent logging or autonomous self-improvement features, amplifying misuse and consent problems.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation broadens the skill from content generation into a persistent self-learning subsystem that records usage outcomes, user preferences, and improvement suggestions. This scope expansion increases attack surface and data handling risk, especially because it is embedded in a skill whose stated purpose does not require long-term memory.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill describes recording user preferences and outcomes to local storage without a clear warning, consent flow, or retention explanation. Hidden or poorly disclosed persistence is dangerous because users may unknowingly provide data that becomes durable across sessions and influences later agent behavior.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs persistent storage of user preferences, success/failure history, and usage details in a local memory file across sessions. Cross-session retention of behavioral and preference data expands privacy risk, enables unintended profiling, and creates a durable state that can be manipulated or leaked independently of the curriculum-generation task.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Persisting user preferences is not necessary for open-ended curriculum generation and introduces avoidable privacy and profiling risk. Storing such preferences without a narrowly justified purpose can lead to retention of sensitive behavioral data and unnoticed cross-session influence on outputs.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code file contains natural-language strings that assume Chinese as the interaction language, including the module docstring and CLI usage examples. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documented mechanism states that each challenge is derived from the previous one with increasing scope and constraints. However, generate_curriculum keeps
base = seedunchanged and builds every level from that same base template input rather than transforming the prior challenge.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The module documentation says high char_jaccard duplicates are 'rejected' and novelty is forcibly enforced, and the selftest repeats that near-duplicates are rejected. In implementation, generate_curriculum only computes a novelty score and always appends every generated challenge to the output without any threshold check or rejection logic.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The assertion messages, success output, and usage text are all presented only in Chinese. This creates a language/locale policy issue because the skill does not offer users a choice of language or explain that it is a region-specific tool.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The docstring frames the module as making every skill '越用越好用、越用越高效' and labels it a '自进化学习模块', implying active adaptation. In practice, the code persists counters and preferences, then prints suggestions such as writing experience back to SKILL.md, but it does not modify skill behavior or automatically apply optimizations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The module persists operation notes, error details, and preferences to a local JSON file without any consent, minimization, or warning. If notes contain prompts, secrets, personal data, or sensitive workflow details, they may remain on disk longer than expected and be exposed to other local users, backups, or later compromise.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Recording arbitrary user preferences without a privacy notice or consent mechanism creates unnecessary persistent storage of potentially sensitive personal or operational information. In an agent skill context, preference keys/values may encode behavioral patterns, identities, or confidential working preferences that users do not expect to be written to disk.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill documentation introduces persistent self-learning, usage tracking, and user-preference storage that materially exceeds the manifest’s stated purpose of generating open-ended curricula. This creates unauthorized statefulness and data retention behavior that can collect user-related information across sessions without clear consent, scope limits, or necessity for the advertised function.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill describes storage of operational history, error patterns, and user preferences but does not warn users that this information will be persisted. Lack of notice undermines informed consent and can lead to unexpected retention of potentially sensitive behavioral or preference data.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instructions create a persistent retention channel for user preferences, operational notes, failures, and error descriptions in a plain JSON file without minimization, sensitivity filtering, or retention boundaries. This increases the risk of storing personal, confidential, or security-relevant information across runs where it may later be exposed or misused.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The example stores
输出语言with the value中文, which indicates a default language preference being set in the skill content. The file does not offer a language choice or explain that this is merely an example, so it may violate language/locale policy by steering behavior toward a specific language without user opt-in.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instructions tell the system to write accumulated experience back into the skill’s own SKILL.md, effectively enabling self-modification of the skill specification. Self-editing behavior expands the skill beyond its declared curriculum-generation role and can be abused to introduce hidden instructions, persistence, or prompt-injection style drift over time.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The early documentation presents the skill's operative closed loop as
scripts/curriculum.pyreturning generated challenges andsaturated=False. Later sections assert the skill 'automatically' performs recording, preference capture, reflection, and even writes experience back toSKILL.md, which materially changes the described behavior and conflicts with the earlier portrayal of the skill as a bounded curriculum generator.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The example preference command hard-codes
输出语言 --val 中文, and the surrounding documentation is entirely Chinese without indicating that language is configurable or user-selected. This can be interpreted as a locale/language default imposed without explicit opt-in.- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The comment says alignment means staying on the provided base topic, but the actual code does not inspect the seed semantically. It assigns high alignment only if the challenge contains '排序' or the literal text 'base', so non-sorting seeds are scored as weakly aligned regardless of whether they remain on topic.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill states that important user preferences are written for automatic reuse in future runs, but it does not clearly warn the user that this reuse will occur by default. Even if the preference seems harmless, silent cross-session reuse creates an undisclosed behavioral memory channel.
- Content