T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:278- Finding
Silent Cross-Session Profile Mutation Can Poison Future Agent Decisions
- Content
View full analysis
- Remediation
View remediation
Security audit
Mental Models
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent mental-models advisor, but it quietly reads and mutates a long-term user profile with inferred blind spots and decision patterns.
Review this before installing if you do not want a skill to maintain cross-session notes about your reasoning, blind spots, risk profile, or decision context. The main risk is not malware; it is silent long-term personalization and automatic profile mutation without explicit approval for each stored observation.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill directs the agent to append session-derived learnings to a persistent profile file and to silently promote recurring behavioral patterns into long-term memory. This is a stronger privacy and profiling issue than simple personalization because it creates durable behavioral tracking from conversations, including inferred blind spots and decision tendencies, without explicit notice or consent.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill instructs silent persistence of session learnings and silent promotion into profile fields, which amounts to undisclosed long-term profiling. Because the stored content includes inferred patterns about the user's thinking and blind spots, the transparency failure is especially serious and can lead to sensitive semantic tracking beyond what users reasonably expect from a reasoning aid.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The section frames execution tasks as situations where the skill should still activate when it detects an embedded judgment node, which conflicts with the stronger earlier description that says execution tasks should never activate. This is an intent contradiction in the documentation itself that changes when the skill is supposed to engage.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 87% confidence
- Finding
The setup step creates a persistent profile file in the workspace specifically for reuse across sessions, introducing statefulness beyond the immediate task. Session persistence is not inherently malicious, but in this skill it becomes risky because the file is later read silently and augmented with inferred user traits, expanding privacy and exposure concerns.
- Content
OpenClaw Setup
On first install, create the user profile file:
bash cp ~/.openclaw/skills/botlearn-mental-models/assets/user-profile-template.md \
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly instructs the agent to read a persistent user profile at session start and use it silently to personalize outputs. That creates undeclared cross-session memory containing user-specific context, blind spots, and risk preferences without clear consent, retention limits, or scope controls, which can expose sensitive behavioral data and influence responses in ways the user cannot see or audit.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill tells the agent to read the profile silently and 'do not announce this,' which conceals use of persisted user data from the user. Hidden data access erodes transparency and informed consent, and it prevents users from understanding when prior personal context is shaping outputs.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Cross-session retention of user-specific context such as expertise, blind spots, and constraints increases the chance of unintended disclosure or overexposure if the file is accessed by other skills, processes, or users on the same environment. Even without exfiltration logic in this skill, the accumulation of sensitive semantic context raises exposure risk and can bias future outputs based on stale or overly personal data.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The logging and promotion workflow stores conversation-derived observations about user behavior and reasoning across sessions, creating a semantic dossier. Such retained inferences can leak sensitive traits, be reused out of context, or compound errors over time, especially because promotion occurs silently after recurrence thresholds are met.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The "Use when" section describes several high-level situations such as people making bad decisions under pressure or a policy not working, but it does not define concrete trigger phrases, boundaries, or exclusions beyond broad conceptual guidance. In a skill-routing context, these generic descriptions may overlap with many ordinary discussions and could cause unintended invocation.
- Content
Static analysis
No suspicious patterns detected.