T09 · Insecure Skill Coding Practices
Error
- Location
prompts/nightly-review.md:25- Finding
Auto-Apply Executes Despite Being Disabled in Configuration
- Content
View full analysis
- Remediation
View remediation
Security audit
lucid-dreamer
Security checks for vulnerabilities and agentic risk
Overview
This is a real memory-maintenance skill, but its unattended prompts can edit and commit long-term memory even when the shipped config says auto-apply is off.
Review the prompts before scheduling. Do not run this on markdown notes containing secrets or untrusted copied content. Keep auto-apply, aggressive cleanup, and the session debrief disabled unless you are comfortable with unattended memory edits and local commits, and verify diffs regularly.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T02 · Agent Memory Poisoning
Error
- Location
prompts/nightly-review.md:14- Finding
Untrusted Daily Notes Can Poison Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (22)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises an automated nightly memory reasoning system that analyzes notes and memory files for various issues and optionally cleans them up. The supplied code does none of that. It is a migration utility for restructuring MEMORY.md into multiple section files and creating an index.md manifest with metadata. While this may relate to memory organization, it is materially different from the claimed primary purpose and lacks the described analytical and scheduled behaviors. Therefore the description does not accurately represent the code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 84% confidence
- Finding
The code aligns partially with the description's general theme of nightly memory review over markdown files with no database/dependencies. It does read daily notes and MEMORY.md, detect recurring problems, and identify stale projects, which fits part of the declared purpose. However, the declared description is significantly broader and presents this as a full memory reasoning/maintenance system with stale fact detection, unresolved todo tracking, forgotten decisions, contradiction detection, aggressive cleanup, and optional debrief capture. None of those capabilities appear in this code chunk. Instead, the actual code is narrowly focused on trend detection and state summarization. There is no evidence of unrelated dangerous behavior or undeclared external access, but the declared description materially overstates what this code does, so this is a mismatch.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The prompt contains mutually inconsistent instructions: it forbids reading previous reviews, then later allows aggressive cleanup based on the previous review. Contradictory control flow in an autonomous file-modifying skill is dangerous because it makes behavior non-deterministic and can cause the agent to bypass intended safety boundaries or choose the more destructive branch.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Aggressive cleanup enables automatic removal of memory entries based on heuristic closure signals and then commits those deletions. This is dangerous because it can irreversibly prune important information or operational context from long-term memory with limited human oversight, especially when natural-language notes are ambiguous or manipulated.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
md - If it exists, append only factual after-midnight context that is not already covered. - Do not create a new today file just because the date rolled over. ## Output rules - Yesterday's file is the main target Lucid needs for the 03:00 run. - Today's file is optional and only updated if it already exists.
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The architecture document states that nothing is auto-applied in V1, but the skill metadata advertises optional aggressive cleanup. This kind of safety-boundary inconsistency is dangerous because operators may rely on the document’s human-approval guarantee while enabling behavior that performs destructive or high-risk memory modification automatically.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README describes an optional session debrief that writes directly into persistent memory without a nearby, explicit warning that this bypasses the normal human review step. In a memory-management skill, direct automated writes can cause silent persistence of hallucinations, prompt-injected content from notes, or sensitive information, especially because users may assume all Lucid changes are review-gated based on the earlier workflow description.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill explicitly describes runtime file reads and writes but does not declare a corresponding tool scope such as permissions or allowed-tools. That creates a trust and review gap: operators cannot easily constrain filesystem access up front, and an automation-capable skill that processes memory files nightly could be granted broader access than intended.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger phrases include broad terms like "lucid," "auto memory," and "memory cleanup," which may match ordinary conversation or unrelated requests. Over-broad activation can cause the skill to run unexpectedly in sensitive contexts, increasing the chance of unintended reads or writes to memory files during normal user interactions.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ## Candidate Updates ### 1. Atlas Agent — New Infrastructure (high confidence) - **Add to Projects section:** `atlas-node` VM (Tailscale `10.0.0.42`) running Atlas agent with GPT-5.4 via OAuth, systemd service `atlas-gateway.service`, lightweight vector memory enabled - **Source:** `memory/2026-03-15.md` (Atlas Agent Setup) + `memory/2026-03-13.md` (initial install) - **Context:** Replaces `old-orbit` (retired 2026-03-13), `Pilot` vs `Atlas` decision still pending as of 2026-03-15
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This sample file embeds concrete internal infrastructure details, including a Tailscale IP, host role, service name, authentication method, and memory capability. Even in documentation, exposing this level of operational detail can aid reconnaissance if the skill outputs, ships, or encourages storing such data in broadly accessible markdown files.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ### 5. awesome-mcp-servers PR #3156 - **Started:** 2026-03-13 — Submitted, waiting on merge after AAA score (2026-03-14) - **Missing:** No confirmation of merge - **Source:** `memory/2026-03-14.md` (web-search-plus-mcp section) ### 6. Morning Briefing Model Switch (Kimi → Sonnet)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The prompt explicitly instructs the agent to execute shell commands and perform git commits, which turns a nominally file-review skill into one that can mutate the workspace and invoke the shell. In a security context, hidden or under-disclosed command execution materially increases risk because prompt-controlled filesystem and VCS actions can cause unintended changes, persistence, or abuse if the surrounding files or environment are adversarial.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The prompt authorizes direct edits to memory files and automatic git commits without a prominent user-facing warning in the skill description. For a skill presented as a memory review utility, silent destructive or persistent modification is risky because users may reasonably expect analysis and suggestions, not autonomous writes and version-control changes.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill claims 'zero dependencies' and a markdown-only memory review flow, yet it instructs execution of an external Python script. This discrepancy widens the attack surface because script execution depends on local code integrity and environment state, allowing behavior not apparent from the manifest and creating opportunities for unexpected code execution.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The prompt explicitly instructs the agent to execute a shell command (
date +%Y-%m-%d) as part of normal operation. Even though this specific command is low risk, permitting command execution in a memory-maintenance skill broadens the action surface beyond simple note processing and normalizes shell access where safer internal date/time mechanisms would suffice.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill directs the agent to edit memory section files directly and create new section files when implied, but provides no user-facing consent or warning that persistent files will be modified. In a memory system, daily notes may contain prompt-injection text or erroneous content, so direct autonomous writes can corrupt long-term memory, introduce false facts, or cause silent data loss through small but cumulative edits.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The prompt instructs the agent to stage and commit repository changes automatically. This modifies repository history, can persist accidental or poisoned memory updates, and exceeds the minimal scope of 'quick capture' because it performs a version-control side effect that may affect unrelated workflows, automation, or auditing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Automatically creating a git commit changes repository history without warning the user. That makes the side effect more durable than a normal file edit, can trigger downstream sync/CI behaviors, and can preserve harmful or mistaken memory updates in history even if later corrected.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 63% confidence
- Finding
The architecture explicitly says review outputs are never read as input, emphasizing anti-circular behavior. Given the manifest advertises contradiction detection and ongoing memory maintenance, this creates an intent-level inconsistency if users would expect prior review outputs to participate in later contradiction analysis; the documentation presents a narrower behavior than the manifest suggests.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The example automation command specifies
--tz "Europe/Vienna", which imposes a locale-specific setting in natural-language guidance. The file does not present this as a user choice in the example itself, so it can steer users toward a fixed locale without explicit opt-in.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The document calls out a missing API key location in a specific config path without any credential-handling warning. While it does not disclose the secret itself, it reveals where a sensitive credential belongs and normalizes placing secret-related operational notes into memory files that may later be surfaced or synced.
- Content
Static analysis
No suspicious patterns detected.