T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:19- Finding
Persistent Hijacking of Agent Response Behavior
- Content
View full analysis
- Remediation
View remediation
Security audit
Deep Token Saver
Security checks for vulnerabilities and agentic risk
Overview
This token-saving skill is not clearly malicious, but it asks for persistent memory services and memory/instruction rewriting without enough safeguards.
Review before installing. Use this only if you intentionally want a persistent local memory service and are comfortable with memory consolidation. Do not let it rewrite AGENTS.md or delete/merge memory automatically unless you have backups, a previewable diff, explicit confirmation, and a rollback path. Verify any RemnicServer scheduled task command, account, network binding, token storage, and removal steps yourself.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:29- Finding
Unsafe Modification and Consolidation of Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
T06 · System Persistence
Error
- Location
SKILL.md:52- Finding
Cross-Session Persistence Through an Auto-Started Scheduled Task
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill description and usage instructions are written as Chinese-only interaction patterns, including the control phrase '正常说话' to restore normal mode. This creates an implicit language requirement without user opt-in or a documented reason for restricting the skill to Chinese.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill is described as a comprehensive token-saving solution spanning compression, memory, and auditing. However, the documentation also specifies OS-level auto-start via a scheduled task (
RemnicServer), which is a host persistence/administration capability rather than an obvious requirement of token reduction behavior.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill recommends merging, compressing, and deleting memory entries, including an API endpoint for consolidation, without warning that these actions may be irreversible or may destroy useful context. If followed automatically or casually, this can lead to data loss, corruption of long-term memory, and degraded agent behavior across sessions.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The maintenance section includes shell execution and directory-changing commands that can cause the agent or user to perform local system actions outside passive documentation. In a skill context, operational commands increase the chance of unintended execution, especially when they touch workspace files or trigger scripts without clear confirmation boundaries.
- Content