Atelier Litteraire : Redaction litteraire, avec idéation et processus itératif. plusieurs agents : idéation, rédaction, jury/correcteurs.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:07 AM UTC
• Version: 1.0.5

Overview

The skill is a coherent local literary-writing workflow, but its Herbert agent automatically uses a shared long-term memory file that is not clearly scoped per project.

Install only if you are comfortable with a writing assistant keeping and reusing local long-term memory. For sensitive or multi-author workspaces, keep separate project directories, inspect or clear MEMORY.md between projects, and avoid storing confidential drafts or personal data there.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: agents/herbert/AGENTS.md:5
• Finding: Unscoped Long-Term Memory Access Creates Cross-Project Data Exposure Risk<![CDATA[ ## Vulnerability Details **File Location**: `agents/herbert/AGENTS.md`, lines 5–9 **Vulnerability Type**: Unscoped access to persistent, workspace-level agent memory **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown Avant toute interaction : 1. Lire `SOUL.md` — la méthode et l'identité 2. Lire `MEMORY.md` — les projets en cours et les leçons apprises 3. Reprendre le contexte du projet en cours si disponible 4. Si un projet est actif : lire sa `bible.md`, son `outline.md`, et les seeds en cours ``` The persistent-memory behavior is reinforced at lines 33–37: ```markdown ## Mémoire - Notes de travail dans les fichiers du projet - Mémoire long terme dans `MEMORY.md` - Écrire, ne pas mémoriser mentalement ``` ### Technical Analysis Herbert is instructed to read a generic `MEMORY.md` before every interaction and use that file for long-term memory. Unlike files stored beneath the documented `projects/{slug-projet}/` structure, this memory file is not scoped to a specific project, author, or session. The package does not define: - Ownership or access controls for `MEMORY.md` - A project-specific memory namespace - Restrictions on storing raw or sensitive user content - Validation that persisted content is data rather than executable agent instructions - User approval before importing information from previous projects - A cleanup or retention policy Consequently, content originating from one project can enter the model context of an unrelated project. If prior project content contains instruction-like text, the agent may also treat persistent data as authoritative operational guidance. This behavior conflicts with `agents/herbert/PIPELINE.md`, lines 31–44, which requires a fresh Herbert session for each project to prevent inherited context. Reading a shared long-term memory file recreates a cross-project context channel despite the fresh-session requirement. ### Attack Path 1. A previous project, user, or imported document causes se ...[truncated 1499 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the shared `MEMORY.md` with project-scoped storage, such as: ```text projects/{project-id}/MEMORY.md ``` 2. Resolve and validate the active project identifier before reading memory. Reject paths that escape the selected project directory. 3. Do not automatically import cross-project memory. Require explicit, informed user confirmation before transferring summaries between projects. 4. Store only structured, minimal, non-sensitive summaries. Do not persist raw manuscripts, credentials, personal information, or complete user conversations in long-term memory. 5. Treat all persisted memory as untrusted data. Add an explicit rule that instructions contained in memory or project documents must never override system, developer, user, or skill-level controls. 6. Add tenant or author isolation where multiple users share a workspace. Enforce separate directories and filesystem permissions for each user and project. 7. Define retention and deletion controls so users can inspect, correct, export, and remove stored memory. 8. Align memory handling with the fresh-session rule in `agents/herbert/PIPELINE.md`: a new project session should load only the files explicitly associated with that project. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This markdown file contains operational instructions exclusively in French, including session startup, writing rules, memory handling, and safety guidance. Under the language/locale policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which it is not here.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: This markdown file contains all operational instructions in French and does not indicate that users may choose another language or that the skill is restricted to a French-speaking context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The title, display name, and keywords indicate the skill is specifically oriented around French-language literary writing (e.g. "redaction", "romans courts", keyword "french"), but the manifest does not state that this locale is optional or limited to a justified region-specific use case. Under the language/locale policy, forcing a specific language without user opt-in can be a policy concern.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: The natural-language description defines the agent persona entirely in French (for example, 'Agent écrivain' and 'Je challenge avant de valider') with no indication that users may choose another language. This can conflict with language/locale policy requirements when the skill implicitly constrains interaction language without explicit opt-in or justification.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: Le contenu du skill est entièrement rédigé en français et le résumé décrit explicitement un agent en français, sans indiquer d'option de langue ou de consentement utilisateur. Cela peut constituer une contrainte implicite de langue/locale, ce qui entre dans la catégorie des violations de politique linguistique en langage naturel.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: This markdown file contains user-facing natural-language instructions and description exclusively in French. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation when no alternative or choice is provided.

Static analysis

No suspicious patterns detected.