Persistent Memory — Local Markdown Context

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 0.8.0

Overview

This skill transparently manages user-approved local Markdown memory files and does not show hidden execution, network access, or deceptive behavior.

Install this only if you want compatible local agents to share reviewed context through plaintext Markdown files on the same filesystem. Do not save secrets, credentials, or sensitive material you would not want another trusted compatible agent on that machine to read, and review every proposed save, archive, delete, or recover operation before confirming.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (13)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

The skill explicitly enables cross-session, cross-agent persistence through a shared local filesystem path, which creates a real privacy and data-exposure risk if multiple agents or processes can read from the same memory directory. Even though the README includes some constraints and warns against storing secrets, persistent shared memory can still leak sensitive personal context across sessions, tools, or trust boundaries if permissions or agent behavior are not tightly controlled.

Content

Scanner excerpt · README.md (reported line 68)May include surrounding context.

md

- Each **compatible agent** can discover this skill or has an equivalent fallback instruction.
- The agents use the **same local filesystem** and resolve `~/.persistent-memory/` to the same location.
- The active user has read/write permission for that location.

Two agents do not automatically share every historical conversation. They share only memory files saved into this folder and only when the conditions above hold.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

- each agent can discover this skill or an equivalent fallback instruction;
- the agents use the same local filesystem and the same `~/.persistent-memory/` path;
- the active user has permission to read and write that path.

Platform memory may coexist. Persistent Memory does not import historical chats or replace an agent's built-in memory.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The save triggers include broad everyday phrases such as 'save this' and 'add to notes', which can appear in normal conversation without the user intending to modify persistent local files. In a skill that writes cross-session memory to disk, accidental activation can cause unintended retention of personal data or creation of misleading memory entries.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction 'the active conversation matches an entry in _index.md' is underspecified and leaves too much discretion to the agent for deciding when to load on-demand memory. Ambiguous matching can cause over-broad memory loading, exposing unrelated personal context to the current conversation or allowing prompt/content collisions to trigger reads unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The save triggers include broad natural-language phrases such as “save this”, “update memory”, and “add to notes”, which can overlap with ordinary conversational requests or application-level actions. In a skill that writes persistent local files, ambiguous activation can cause unintended memory creation or modification, especially if another agent auto-routes based on trigger phrases rather than requiring explicit scope confirmation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The delete trigger includes the broad phrase “remove file”, which can easily collide with generic file-management requests unrelated to this memory system. Even though the skill requires archived-only deletion and confirmation, accidental invocation could still steer an agent into a destructive workflow against persistent memory when the user intended some other file operation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · docs/superpowers/plans/2026-07-14-v071-reliability.md (reported line 41)May include surrounding context.

• Consumes: SKILL.md, SKILL_zh.md, README.md, README_zh.md as UTF-8 text.

• Produces: node --test tests/skill-contract.test.mjs with one named assertion per published behavior.

• Step 1: Write the failing test

js

import assert from 'node:assert/strict';

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · tests/fixtures/v08-summary-first/legacy-guide.md (reported line 91)May include surrounding context.

md

- A reader seeking the old folder name must continue to full details.
- A reader should state when a requested fact is not present in the summary.
- A reader should not infer unlisted details from a file title.
- A reader should not announce a rule without checking whether it is current.
- A reader should keep historical and active claims separate.
- A reader should cite the file role that supports an answer.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 65% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · README.md (reported line 94)May include surrounding context.

md

Keep stable identity, preferences, decisions, concise project state, and pointers to source material here.

Keep raw repositories, downloads, media files, and datasets in their original project workspaces. A memory note should point to them and explain why they matter; it should not become a general-purpose file warehouse.

## Privacy

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

L120 把 move to archive 作为触发词，但该短语可用于许多非本技能场景，文中也未说明只有在 persistent-memory 上下文中才生效。缺少作用域限制会增加误调用风险。

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

L153 列出的 restore file 可对应广泛的日常文件恢复需求，而不一定是该技能管理的记忆文件。未提供负例或明确限定到 _archive/ / _trash/ 语境，存在误触发空间。

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

L168 的 clean up memory 既可能指本技能的记忆文件整理，也可能被理解为聊天上下文、模型记忆或其他系统状态清理。说明中未给出排除条件或更明确的范围界定。

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This SVG is documentation-like content, so SQP-2 applies as a markdown-style disclosure check for user-affecting behavior. The diagram explicitly shows identity, preferences, and project notes being shared through a common local memory layer, but it does not warn users that sensitive personal or project data may become accessible to multiple compatible agents on the same filesystem.

Content

No source excerpt is available for this finding.