T02 · Agent Memory Poisoning
Error
- Location
references/project-config.md:15- Finding
Persistent Agent Configuration Poisoning Through Unconditional Always-Load Directives
- Content
View full analysis
- Remediation
View remediation
Security audit
golang-how-to
Security checks for vulnerabilities and agentic risk
Overview
This Go helper is mostly coherent, but it directs agents to make persistent future-agent instruction changes without explicit user approval.
Review before installing. The skill can be useful for Go work, but do not let it modify CLAUDE.md, AGENTS.md, GEMINI.md, Cursor rules, or Copilot instructions unless you have seen the exact diff and want future agents to auto-load these Go skills. Prefer a pinned gopls version.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:14- Finding
Mutable Latest Version Used for Executable gopls Dependency
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill states that the project-layout skill writes an always-load directive automatically at project creation, with no user confirmation needed. This is dangerous because it persistently alters agent instruction files and can force future skill execution across the repository without informed consent, creating a durable prompt-injection and policy-manipulation surface.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description says the orchestrator is "always active on any Golang coding, review, debug, or setup task," which is broad enough to trigger on incidental or low-risk Go mentions. In a skill-routing system, overly broad activation can cause unintended tool use, extra context loading, and security-relevant side effects when the skill later recommends configuration changes or invokes auxiliary tooling.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The instruction "For every Go task, identify all relevant skills and load them together" is ambiguous and encourages maximal loading without clear boundaries. This increases the chance of unnecessary privilege use, hidden behavior, or accidental activation of skills with write or shell capabilities, especially in mixed-context conversations where "Go task" is not tightly defined.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Configure mode directs the agent to write to project agent-config files but does not prominently warn that this changes persistent instruction surfaces that may affect future agent behavior. Modifying files like CLAUDE.md or AGENTS.md can create durable auto-invocation behavior, so users need explicit notice and consent before those files are changed.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The guidance says any new Go project should get an always-load directive, which broadens activation based on general project state rather than a narrowly scoped user request. In an agent skill, this can cause persistent behavior changes across future sessions and expand the skill’s influence beyond the immediate task, increasing the chance of unnecessary or unintended instruction loading.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 98% confidence
- Finding
The phrase 'without asking the user' explicitly authorizes autonomous modification of project instruction files during project creation. In this context, that is risky because these files are high-leverage control points for downstream agent behavior, so an unapproved change can persistently force skill loading and reduce user control over later interactions.
- Content
md ### When it gets written - **At project creation** — the `samber/cc-skills-golang@golang-project-layout` skill writes this directive automatically as part of its Initialization Checklist, without asking the user. - **On demand** — running `/golang-how-to configure` writes it too (if missing), in addition to any `## Required Go skills` block confirmed in Step 3 below. ### Insertion point
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file instructs the agent to modify project configuration files automatically and frames some of those changes as not needing user confirmation. That is dangerous because it normalizes persistent file edits to agent-control surfaces without a clear user-facing warning, which can silently alter future agent behavior and repository policy.
- Content
Static analysis
No suspicious patterns detected.