T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:53- Finding
Unvalidated User Instructions Can Poison Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
My Self Improving
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent memory tool, but it persistently changes future agent behavior and workspace steering in ways users should review before installing.
Install only if you want the agent to keep cross-session local memory and change workspace steering files so that memory is loaded and updated during future work. Before enabling it, review proposed AGENTS.md, SOUL.md, and HEARTBEAT.md diffs, avoid storing sensitive personal or credential information, and decline or separately audit the optional proactivity skill unless its publisher and version are pinned.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T02 · Agent Memory Poisoning
Warning
- Location
setup.md:62- Finding
Setup Persistently Modifies Workspace Steering Beyond the Declared Storage Scope
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
setup.md:90- Finding
Unpinned Companion Skill Is Installed and Activated from a Mutable Registry
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill states that workspace setup should add steering to AGENTS, SOUL, and HEARTBEAT.md, but it does not prominently warn that activating setup may modify workspace files. Silent or poorly disclosed modification of project instruction files can surprise users, alter agent behavior for future tasks, and create trust and integrity issues in the workspace.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill directs the agent to automatically log user corrections, preferences, and repeated instructions into persistent local files, but it does not require a clear user-facing notice or consent at the moment of collection. This creates a privacy and transparency risk because users may unknowingly provide sensitive preferences or personal data that become durable state across sessions.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 81% confidence
- Finding
The skill authorizes autonomous promotion, demotion, and archival of learned patterns based on heuristics and time thresholds without requiring user confirmation. Although bounded to the skill's memory store, this still changes persistent agent behavior and retained state automatically, which can reinforce bad inferences or unexpectedly suppress useful context.
- Content
md - Pattern used 3x in 7 days → promote to HOT - Pattern unused 30 days → demote to WARM - Pattern unused 90 days → archive to COLD - Never delete without asking ### 4. Namespace Isolation - Project patterns stay in `projects/{name}.md`
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | Financial | Card numbers, bank accounts, crypto seeds | Fraud risk | | Medical | Diagnoses, medications, conditions | Privacy, HIPAA | | Biometric | Voice patterns, behavioral fingerprints | Identity theft | | Third parties | Info about other people | No consent obtained | | Location patterns | Home/work addresses, routines | Physical safety | | Access patterns | What systems user has access to | Privilege escalation |
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The kill switch is triggered by a single broad natural-language phrase, "forget everything," which could be said in normal conversation, quoted, or referenced hypothetically. In a self-improving memory skill, accidental activation could cause unintended export and deletion of learned state, creating integrity and availability issues and potentially exposing memory contents during the export step.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly instructs the agent to log user corrections, repeated behaviors, and project-scoped preferences, but it does not disclose retention, storage location, access boundaries, or consent expectations. In a self-improving memory skill, that omission creates a real privacy and transparency risk because users may unknowingly provide persistent behavioral data that can be stored beyond the current session.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The reversal flow says the agent will keep history, log reversals, and attach timestamps, which implies ongoing retention of historical preference records without notifying the user how long that history persists or whether it can be removed. Because this skill is designed for permanent self-learning and memory organization, hidden retention of historical behavioral data is more dangerous here than in a transient workflow.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill presents itself as self-improvement through corrections, but the operations define a broad persistent memory subsystem with search, export, full wipe, namespaces, status reporting, and maintenance behavior. That scope expansion is security-relevant because it increases the amount of user data stored and processed beyond what is necessary for the stated purpose, creating unnecessary privacy and abuse risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill automatically loads memory on session start and writes corrections to persistent files without any explicit user-facing notice or consent at the time of access. Silent persistence is dangerous because users may reveal preferences, work context, or sensitive project details assuming they are transient, when the system is actually storing and reusing them across sessions.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Automatic correction logging stores user-provided context, timestamps, and potentially detailed interaction history in persistent memory without evidence of minimization. This creates a risk of collecting more sensitive information than needed, especially when contextual notes may contain project names, behavioral preferences, or other personal/workflow metadata.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The weekly cron maintenance introduces autonomous background processing of stored user data, including movement between tiers, archival, compaction, and digest generation. Even if intended for housekeeping, unattended retention and transformation of personal or project data increases privacy risk and can preserve information longer or in different forms than users expect.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The maintenance section describes automated archival, compaction, and digest generation but does not warn users that their stored data may be moved, summarized, or retained in secondary forms. This is risky because data lifecycle changes can undermine user expectations about deletion, recency, and visibility of previously stored information.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
Preserving archived preference history for future recall means prior user statements remain available even after the user changes their mind. That can be dangerous because outdated or sensitive preferences may continue to influence behavior, and retained historical statements may reveal user traits or prior contexts that the user expected to be superseded.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file explicitly instructs creating directories and files under the user's home directory on first activation, which causes persistent local state changes. While the content appears intended for legitimate memory storage, it still modifies the filesystem without any warning, confirmation step, or explanation of side effects, which is a real security and safety concern for an agent skill.
- Content