T02 · Agent Memory Poisoning
Warning
- Location
auto_log_skill.py:95- Finding
Persistent Agent Memory Poisoning Through Unescaped Log Entries
- Content
View full analysis
- Remediation
View remediation
Security audit
Auto Log
Security checks for vulnerabilities and agentic risk
Overview
This skill is a straightforward local daily logging helper, with privacy and hardening notes around what gets persisted to disk.
Before installing, choose a private memory_dir, avoid logging secrets or sensitive prompts, periodically review or delete retained logs, and ensure any agent that reads these files treats them only as historical data, not executable instructions.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
auto_log_skill.py:217- Finding
Predictable Log Files Follow Symbolic Links During Reads and Writes
- Content
View full analysis
Path: """Return the file path for today's log.""" today = datetime.now().strftime("%Y-%m-%d") return self.memory_dir / f"{today}.md" ``` ```python # auto_log_skill.py:217-229 log_path = self.get_today_log_path() if not log_path.exists(): return "📝 No log created for today yet" try: with open(log_path, 'r', encoding='utf-8') as f: content = f.read() summary = content[:500] if len(content) > 500: summary += "\n... (see full log for more)" return summary ``` Representative write operation: ```python # auto_log_skill.py:153-161 new_line = f"| {task} | {status} | {result} |\n" content = content[:table_end] + new_line + content[table_end:] with open(log_path, 'w', encoding='utf-8') as f: f.write(content) return True ``` ### Technical Analysis The daily filename is predictable because it is derived solely from the current date. The code uses ordinary Python `open()` calls, which follow symbolic links by default. It does not use `lstat()`, no-follow file-opening flags, or resolved-path validation before reading or rewriting the file. If the configured `memory_dir` is writable by another local user or process, that party can create the expected `YYYY-MM-DD.md` entry as a symbolic link to another file accessible to the Skill's process. The summary operation can then read the linked target, while event, task, and todo operations can modify or corrupt it. The default directory is user-scoped, which reduces practical likelihood. The issue becomes exploitable when users configure a shared, group-writable, or otherwise insuf ...[truncated 1156 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README explicitly advertises automatic activity logging and daily file creation, but it does not warn users that agent actions, task details, and other potentially sensitive operational data will be persisted to disk. In an agent environment, this can lead to unintentional storage of secrets, internal prompts, API-related details, or personal data in predictable locations, increasing exposure through local compromise, backups, sync tools, or accidental sharing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly states it will 'automatically record' agent activity and lists file_write as a required tool, but the description does not clearly warn users that it will persistently append data to daily log files. This can lead to unintentional storage of sensitive prompts, task data, or secrets in memory files, especially when used in agent environments where activity may include confidential information.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README prominently describes automatic creation and recording of logs, events, tasks, and todos, but does not clearly warn users that these operations persist data to files under a configured directory. In an agent skill context, silent or insufficiently disclosed persistence can cause unintentional retention of sensitive operational data, conversation-derived content, or task metadata.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The generated log template always inserts "Timezone: UTC+8", which imposes a specific locale setting in natural-language output. The file does not offer user opt-in, configuration, or any documented region-specific justification for this constraint.
- Content