Security audit

Memory Hierarchy

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent local memory tool, but it automatically persists personal and project context without clear consent, scope limits, or deletion controls.

Install only if you want an agent to keep long-lived local notes about you, your projects, and external system references. Review the memory directory regularly, avoid storing secrets or confidential details, and consider adding explicit confirmation, retention, deletion, and untrusted-data handling before routine use.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

Location: scripts/save.sh:51
Finding: Persistent Agent Memory Poisoning Through Untrusted Content
Content: View full analysis
> "$MEMORY_FILE" << EOF --- name: ${NAME} description: ${DESCRIPTION} type: ${TYPE} date: ${TODAY} --- ${CONTENT:-${DESCRIPTION}} EOF ``` ### Technical Analysis The Skill requires user-supplied preferences, feedback, identity information, project context, and external-system references to be persisted. The save operation inserts `NAME`, `DESCRIPTION`, and `CONTENT` directly into a Markdown file without separating trusted Agent instructions from untrusted remembered data. The only relevant content validation rejects the literal sequence `../`. It does not: - Restrict multiline values. - Escape Markdown or YAML front-matter delimiters. - Prevent instruction-like content from being stored. - Record the source or trust level of an entry. - Require confirmation before persistence. - Ensure that stored content is interpreted exclusively as data. The reading procedure then instructs the Agent to read every Markdown file under `memory/`. Consequently, attacker-controlled text can cross a session boundary and be presented to a future Agent as part of its persistent context. ### Attack Path 1. An attacker supplies a statement that qualifies as a preference, correction, identity detail, project update, or external-resource reference. 2. The statement includes instruction-like content intended to influence a futu ...[truncated 1021 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/save.sh:35
Finding: Arbitrary File Append Through a Pre-existing Symbolic Link
Content: View full analysis
> "$MEMORY_FILE" echo "" >> "$MEMORY_FILE" fi cat >> "$MEMORY_FILE" << EOF ``` ### Technical Analysis The path validation is lexical: it checks whether the constructed string starts with `${WORKSPACE}/memory/`. This does not verify the canonical destination after symbolic-link resolution. The subsequent `>>` redirections follow symbolic links. If an attacker can create or replace the dated memory file with a symbolic link, the script appends its generated Markdown to the link target. The `-f` check also follows symbolic links and does not reject them. The exploit requires write access to the configured workspace or one of its memory subdirectories. There is no evidence that this script independently grants such access. ### Attack Path 1. The attacker obtains write access to `${MEMORY_WORKSPACE}/memory/user/` or another allowed type directory. 2. The attacker determines the current date used by `date +%Y-%m-%d`. 3. The attacker creates a symbolic link such as: ```bash ln -s /path/to/writable/target \ "${MEMORY_WORKSPACE}/memory/user/YYYY-MM-DD.md" ``` 4. A victim or automated Agent invokes: ```bash bash scripts/save.sh user name description content ``` 5. The lexical prefix validation succeeds because the symbolic-link pathname is inside the memory directory. 6. Shell redirection follows the symbolic link and appends generated content to the target file. ### Impact Assessment The script can append attacker-influenced memor ...[truncated 499 chars]
Remediation: View remediation
&2 exit 1 fi ``` 2. Canonicalize the workspace and destination parent with `realpath` and verify that the resolved parent remains beneath the intended memory root. 3. Ensure the workspace and memory directories are owned by the executing user and are not writable by other users; use restrictive permissions such as `0700` for directories and `0600` for memory files. 4. Create new files atomically with exclusive creation and no-follow semantics. A small helper written in a language exposing `O_CREAT | O_EXCL | O_NOFOLLOW` is preferable to shell redirection. 5. For existing files, open them with no-follow behavior and verify with `fstat` that the opened object is a regular file owned by the expected user. 6. Avoid relying on a check followed by a separate write operation, because that creates a time-of-check/time-of-use race. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs cross-session storage of personal details, preferences, feedback, project context, and references to external systems. In context, this expands the agent's retention surface and can accumulate sensitive user and organizational metadata over time, creating privacy, confidentiality, and unauthorized profiling risks if the memory store is exposed or misused.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill mandates persisting user preferences, identity, goals, project progress, and external system references into long-lived files, but it provides no notice, consent, or confirmation step before storing potentially sensitive data. This creates a privacy and data-governance risk because users may disclose personal or organizational information in normal conversation without realizing it will be retained across sessions.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The read/write flow requires reading all memory files and continuously appending new user data into dated records, which encourages broad ingestion and long-term accumulation. This design increases over-collection and makes irrelevant or stale sensitive data more likely to be surfaced in future contexts, amplifying privacy and leakage risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The write workflow directly instructs the agent to classify, merge, and write memories to dated files with no requirement to warn the user or confirm persistence. Automatic retention increases the chance of silently storing sensitive preferences, identity details, or business context that should remain ephemeral.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file contains user-facing natural-language strings only in Chinese, including the validation error and listing labels. This imposes a specific language on users without offering a choice or documenting that the skill is intended only for a Chinese-speaking or region-specific context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script emits usage and status messages in Chinese, which imposes a specific language on all users. Under the policy, locale or language restrictions should either provide user choice or be clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill description forces a specific language presentation in Chinese, and the rest of the operational instructions are likewise Chinese-only. Under the policy, a language constraint should either offer user choice or be clearly justified as locale-specific; neither is stated here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This shell script’s natural-language comments and all visible status messages are written only in Chinese, which imposes a specific language/locale on users without offering a choice. The policy allows locale constraints only when justified or explicitly opt-in, neither of which is present here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: This shell script creates directories and appends user-supplied data into a workspace file, which affects persistent user data. Although it prints a success message afterward, there is no advance warning, confirmation, or explicit disclosure in the comments beyond a terse 'write memory' label, so users are not clearly informed before the write occurs.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.