T02 · Agent Memory Poisoning
Warning
- Location
scripts/learner.py:65- Finding
Unvalidated attacker-controlled values can poison persistent agent state
- Content
View full analysis
- Remediation
View remediation
Security audit
super-agent-integration
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its integration-testing purpose, but it also persists user preferences and directs future agents to write learned experience back into the skill instructions, which should be reviewed before use.
Install only if you are comfortable with local persistent learning files and with agents potentially modifying the skill's own instructions. Before use, remove or disable the SKILL.md write-back rule, restrict learner.py to this skill directory, and avoid storing secrets, personal data, or policy-like instructions in learned_patterns.json.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (21)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The manifest claims a real end-to-end agent integration with multiple imported engines, health scoring, and closed-loop execution, but the documented behavior appears to be only local learning/history persistence. This mismatch is dangerous because operators may grant trust, permissions, or deployment approval based on claimed capabilities that do not exist, while hidden persistence features operate under a misleading description.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs writing accumulated experience back into its own SKILL.md, effectively enabling self-modification of the skill’s behavior and documentation outside the declared scope. Self-modifying instructions are dangerous because they can permanently alter future execution, bypass review processes, and turn transient prompt/input issues into persistent compromise or policy drift.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill documents file-writing behavior and persistent local storage but does not declare any explicit tool scope or permissions boundary. In an agent ecosystem, undeclared write capability weakens reviewability and can enable unexpected state changes or data persistence beyond what users and orchestrators anticipate.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill adds a persistent self-evolution subsystem that records usage history and preferences, even though its stated purpose is validating an agent integration loop. This expands data collection and retention beyond the apparent core function, creating unnecessary privacy and security exposure if user data, task history, or operational details are stored long-term.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
Long-term storage of user preferences and learning data is not clearly necessary for measuring whether an agent loop ran successfully. Collecting persistent data without a tight functional justification increases the blast radius of compromise and raises the chance of retaining sensitive operational or personal information unnecessarily.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation describes persistent storage of usage history and preferences without prominently warning users that their data will be retained locally for future reuse. Lack of disclosure undermines informed consent and can lead to accidental storage of sensitive information that users did not expect to persist.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The instructions describe recording usage details, error patterns, and preferences into a local memory file without clear minimization or sensitivity boundaries. This invites over-collection, making it easy for operators or users to store personal data, proprietary task details, or failure context that may later be exposed or misused.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The examples explicitly encourage logging detailed failure reasons, notes, and user-specific preferences for future reuse. Such free-form notes commonly capture sensitive information, and persistent reuse of that data increases privacy risk and the chance of leaking internal workflows, user attributes, or confidential inputs.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The example persists a language preference ('输出语言=中文') for future automatic use without showing any consent or confirmation step. While lower impact than broader data retention issues, silently fixing user preferences can cause unintended behavior and demonstrates a pattern of storing user-specific settings without opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module docstring, usage text, and user-facing descriptions are entirely in Chinese, and the script provides no indication that users may choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The only visible usage/help message shown on incorrect invocation is in Chinese, with no mechanism for locale selection. This is a direct user-facing language constraint and may violate the language/locale policy when not explicitly optional or justified.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest describes a skill that imports and runs planner, reason-verify, memory-cross-engine, reflection-replanner, bootstrap, and evaluation harness components to execute a measurable end-to-end autonomous-agent loop. This file instead implements a standalone generic telemetry/learning utility that records usage, preferences, and simple reflection suggestions, with no orchestration of the claimed super-agent pipeline.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
All user-facing natural-language documentation and CLI descriptions in this file are written only in Chinese, with no indication that language is configurable or intentionally region-scoped. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The code accepts an arbitrary skill directory and writes learned_patterns.json there, including under ~/.workbuddy/skills or any filesystem path supplied by the caller. In a larger agent ecosystem, this enables unauthorized cross-skill state modification, data pollution, and persistence in locations broader than the skill's stated purpose, especially if higher-privilege components invoke it with untrusted input.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The learner persists user preferences, notes, and activity history to disk without any notice, consent, retention control, or redaction. If notes contain secrets, personal data, or task contents, this creates privacy leakage and long-lived local sensitive storage that other processes or users may later read.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill documentation adds a persistent self-learning subsystem that stores operational history, errors, and preferences, which exceeds the stated role of orchestrating and evaluating an end-to-end agent loop. This scope expansion is dangerous because it introduces undeclared statefulness and data retention that can affect future runs, leak prior user context, or create hard-to-audit behavior drift.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation instructs the skill to persist user preferences, error history, and usage telemetry in a local file despite the skill being framed as an integration/evaluation tool. This creates unnecessary retention of potentially sensitive interaction data and enables cross-session profiling or leakage without a clear need-to-know basis.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The markdown tells operators to retain user preferences and usage history but provides no warning, consent flow, or privacy notice. This is dangerous because users and deployers may unknowingly store personal or sensitive behavioral data locally, increasing compliance and disclosure risk.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instructions explicitly collect and reuse user preferences, error details, notes, and interaction history in a persistent local memory file. This creates a natural-language data retention channel that can accumulate sensitive information over time and later surface it in unrelated sessions, logs, or file disclosures.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The example stores
输出语言with the value中文, which promotes a fixed language preference in the skill's learned behavior. There is no accompanying text indicating that language should be chosen by the user or that other locales are supported by opt-in.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The markdown directs writing learned data back into skill files without any warning that local files will be modified. Undisclosed local modification is risky because it can break reproducibility, introduce unauthorized persistent changes, and make later behavior differ from the reviewed version of the skill.
- Content
Static analysis
No suspicious patterns detected.