Memory Tiering

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:15 PM UTC
• Version: 1.0.0

Overview

This memory-management skill is not malicious, but it can automatically read and rewrite broad memory files, logs, and possible credentials without enough user control.

Review this skill before installing if your agent memory may contain secrets, private logs, or important audit history. It should be used only with explicit user review, backups or version history, mandatory secret redaction, and clear limits on which memory files and date ranges may be processed.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:12
• Finding: Unrestricted Access to Sensitive Agent Memory and Daily Logs<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 12-27 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: High ### Vulnerable Code ```markdown 1. **🔥 HOT (memory/hot/HOT_MEMORY.md)**: * **Focus**: Current session context, active tasks, temporary credentials, immediate goals. * **Management**: Updated frequently. Pruned aggressively once tasks are completed. 2. **🌡️ WARM (memory/warm/WARM_MEMORY.md)**: * **Focus**: User preferences (Hui's style, timezone), core system inventory, stable configurations, recurring interests. * **Management**: Updated when preferences change or new stable tools are added. 3. **❄️ COLD (MEMORY.md)**: * **Focus**: Long-term archive, historical decisions, project milestones, distilled lessons. * **Management**: Updated during archival phases. Detail is replaced by summaries. ## Workflow: `Organize-Memory` Whenever a memory reorganization is triggered (manual or post-compaction), follow these steps: ### Step 1: Ingest & Audit - Read all three tiers and recent daily logs (`memory/YYYY-MM-DD.md`). ``` ### Technical Analysis The workflow directs the agent to read every memory tier and recent daily logs. The HOT tier is explicitly expected to contain temporary credentials, while WARM and COLD can contain user preferences, system inventory, stable configurations, and historical information. No allowlist, minimum-necessary scope, consent boundary, secret exclusion rule, or access-control check limits this bulk ingestion. Consequently, a routine memory-maintenance operation can expose information unrelated to the immediate task. This violates least-privilege principles because pruning or summarizing a specific record does not inherently require unrestricted access to all memory and log content. ### Attack Path 1. An attacker or untrusted instruction causes the user or agent to invoke memory tiering. 2. The skill follows Step 1 and ...[truncated 820 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Require the caller to identify the specific memory tiers, records, or date ranges that may be processed. - Default to metadata or indexes rather than loading complete memory files. - Exclude credentials, authentication tokens, private keys, and other secret-bearing records from ingestion. - Require explicit user confirmation before reading daily logs or unrelated memory tiers. - Apply data classification and access-control checks before adding memory content to the active context. - Process each record in isolation where possible to prevent unrelated sensitive data from entering a shared prompt context. - Record an audit trail identifying which files and records were accessed during each run. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:35
• Finding: Plaintext Credentials Permitted in HOT Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 35-37 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: High ### Vulnerable Code ```markdown ### Step 3: Pruning & Summarization - Remove granular details from COLD. - Ensure credentials in HOT point to their root files rather than storing raw secrets (if possible). ``` The HOT tier is defined earlier as follows: ```markdown 1. **🔥 HOT (memory/hot/HOT_MEMORY.md)**: * **Focus**: Current session context, active tasks, temporary credentials, immediate goals. ``` ### Technical Analysis The design explicitly allows temporary credentials in HOT memory. The instruction to replace raw credentials with references is qualified by “if possible,” making secret removal optional rather than mandatory. There is no requirement for automatic secret detection, redaction, encryption, restricted file permissions, integration with a secret manager, expiration, or secure deletion. If reference conversion is unavailable or fails, the workflow can retain raw credentials in a persistent Markdown file and repeatedly load them during later memory operations. ### Attack Path 1. A temporary credential is recorded in `memory/hot/HOT_MEMORY.md` as part of active session context. 2. Memory tiering processes the HOT tier. 3. Reference conversion is unavailable, fails, or is skipped because the instruction only requires it “if possible.” 4. The raw credential remains in plaintext in HOT memory. 5. A subsequent memory-tiering run, agent session, local process, backup operation, or malicious prompt reads the file and obtains the credential. 6. The exposed credential is used within the permissions granted to that credential. ### Impact Assessment The attainable privileges depend on the exposed credential. Potential impact includes unauthorized access to APIs, external services, repositories, administrative interfaces, or internal systems. Repeated loading into model context also i ...[truncated 228 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Prohibit raw credentials and other secrets in every memory tier. - Store credentials only in an approved secret manager or operating-system credential store. - Keep only opaque secret identifiers or references in memory files. - Add mandatory secret scanning and redaction before memory content is read, summarized, moved, or written. - Fail closed when a raw secret cannot be converted into a safe reference; do not retain it as a fallback. - Apply restrictive file permissions and encryption at rest to memory storage. - Define expiration and secure-deletion procedures for temporary secret references. - Prevent secrets from being included in logs, summaries, model outputs, backups, or version-control history. - Revoke and rotate any credential discovered in plaintext memory. ]]>

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:26
• Finding: Untrusted Session and Log Content Can Be Promoted into Persistent Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 26-33 and 43-45 **Vulnerability Type**: `T02: Agent Memory Poisoning` **Risk Level**: High ### Vulnerable Code ```markdown ### Step 1: Ingest & Audit - Read all three tiers and recent daily logs (`memory/YYYY-MM-DD.md`). - Identify "Dead Context" (completed tasks, resolved bugs). ### Step 2: Tier Redistribution - **Move to HOT**: Anything requiring immediate attention in the next 2-3 turns. - **Move to WARM**: New facts about the user or system that are permanent. - **Move to COLD**: Completed high-level project summaries. ``` The workflow may also be triggered automatically: ```markdown ## Usage Trigger - Trigger manually with: "Run memory tiering" or "整理记忆层级". - Trigger automatically after any `/compact` command. ``` ### Technical Analysis The workflow reads session-derived memory and daily logs, interprets their contents, and promotes selected information into WARM or COLD persistent memory. It does not require provenance validation, trust classification, schema validation, conflict detection, or explicit user approval before persistent writes. Content in logs or current-session memory can originate from websites, documents, tool output, other users, or prior prompt injections. Without an instruction-data boundary, attacker-authored text can be misclassified as a permanent user preference, system fact, or historical decision. Automatic execution after `/compact` further reduces the opportunity for the user to inspect and reject proposed persistent changes. ### Attack Path 1. An attacker places crafted content into a document, tool response, conversation, daily log, or another source that is later represented in agent memory. 2. The content falsely presents itself as a permanent user preference, system configuration, project decision, or instruction for future sessions. 3. A `/compact` command automatically triggers the memory-tiering workflow, or the workflow is invoked manually ...[truncated 805 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Treat all session content, logs, documents, and tool output as untrusted data. - Never interpret instructions embedded in memory records as executable skill instructions. - Attach provenance, source identity, timestamp, and trust level to every candidate memory item. - Require explicit user review and approval before writing new information into WARM or COLD memory. - Disable automatic persistent writes after `/compact`; automatic processing should only generate a proposed change set. - Restrict persistent records to a defined schema and reject behavioral rules, security overrides, credentials, and tool directives. - Validate purported user preferences directly with the user. - Validate system facts against authoritative local configuration or trusted inventory sources. - Detect conflicts with existing trusted records and quarantine suspicious entries instead of overwriting them. - Maintain revision history and provide a rollback mechanism for poisoned memory entries. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to read and modify multiple memory files and daily logs, which may contain sensitive user data or references to credentials, but it does not clearly warn about that access scope or require confirmation before bulk inspection. In a memory-management skill, this increases the chance of over-collection, unintended exposure, or unsafe handling of sensitive material during reorganization.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The pruning and summarization step authorizes removal or replacement of stored details without an explicit data-loss warning, backup requirement, or reversible process. In a skill designed to reorganize memory, this can lead to irreversible loss of important context, security-relevant audit history, or references needed for later validation.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The usage trigger lists both an English and a Chinese phrase, but the document does not explain whether multilingual triggering is optional, configurable, or user-selected. This can create an implicit locale/language behavior without explicit opt-in or policy justification.

Static analysis

No suspicious patterns detected.