T09 · Insecure Skill Coding Practices
- Location
references/evolution-memory.md:4- Finding
Persistent preference memory may be written without explicit user consent
- Content
View full analysis
Vulnerability Details
File Location:
references/evolution-memory.md:4
Vulnerability Type: Conflicting persistent-memory consent instructions
Risk Level: MediumVulnerable Snippet
The following is an English rendering of the complete relevant source block:
markdown # Jimeng Prompt Master — Evolution Memory > v3.0 lightweight evolution engine. Records visual preferences from each session and automatically injects them into the Director's visual intent card across sessions. > Automatically appended after each session, with incremental updates to the summary section at the top. Do not edit manually.This conflicts with the consent requirements in
SKILL.md:731-740andSKILL.md:749-752, which require the Agent to ask before writing:markdown - When the user explicitly expresses satisfaction, ask whether the preference should be recorded. - When the user provides negative feedback, ask whether the avoidance preference should be recorded. - When the user changes the topic, ask whether this session's preferences should be recorded locally. - Removed: automatic writing to evolution memory. - Writing now occurs only after obtaining consent.It also conflicts with
PRIVACY.md:29-35, which states that consent is required before every write and that user data will not be written silently.Technical Analysis
This project is an instruction-driven Agent Skill, so Markdown directives define operational behavior even though no executable scripts are present. The bundled memory file instructs the Agent to append session information automatically and tells users not to edit the file. That instruction directly contradicts the normative consent gate elsewhere in the package.
If the Agent treats the memory file as an authoritative reference, it may execute the automatic-write instruction after a session without first obtaining affirmative consent. The data schema described in
SKILL.mdin ...[truncated 2064 chars]- Remediation
View remediation
Remediation Suggestions
-
Replace the automatic-write directive in
references/evolution-memory.mdwith an explicit consent requirement, for example:markdown > Append a session record only after the user gives explicit affirmative consent. If consent is absent, ambiguous, or denied, do not write or update this file. -
Declare
SKILL.mdas the sole authoritative policy for preference-memory operations. Reference files should contain data only and should not redefine write authorization. -
Add a fail-closed conflict rule:
markdown If any bundled instruction conflicts with the consent policy, do not write persistent memory. -
Require consent to be specific to the current write. Do not treat prior consent, silence, topic changes, or general acknowledgments as authorization for later sessions.
-
Before writing, show the user the exact categories that will be stored and permit selective exclusion.
-
Record consent status separately from preference content so the Agent can verify that every persisted entry has corresponding affirmative authorization.
-
Add validation tests that scan bundled documentation for phrases equivalent to automatic writing and reject releases that contradict the consent policy.
-
Clarify the retention statement. The current policy advertises a 90-day default but only recommends manual cleanup. Either implement consent-aware expiration or state clearly that deletion is user-managed.
-