T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:154- Finding
Automatic Plaintext Persistence of Potentially Sensitive Information
- Content
View full analysis
- Remediation
View remediation
Security audit
Self Learning Agent
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent local memory skill, but it stores broad session-derived information automatically and can promote learned content into permanent agent instructions without clear user approval.
Install only if you are comfortable with an agent writing durable local memory. Before using it, require confirmation before saving personal, infrastructure, credential-adjacent, or project-confidential information; keep memory files out of source control; add deletion and review practices; and disable or manually approve any AGENTS.md promotion.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:193- Finding
Untrusted Session Content Can Be Promoted into Persistent Agent Instructions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The workflow explicitly instructs the agent to log the session to a daily file after doing work, creating a broad sink for task context that may include sensitive prompts, outputs, decisions, and operational details. Because this skill is designed for cross-session recall, those logs can later leak prior-session context into unrelated tasks or to unauthorized readers of the workspace.
- Content
├── [Do work] │ ├── Capture insights → knowledge cards ├── Log session → daily log │ Session End
text
Persistent Context Injection
Medium
- Category
- Memory Poisoning
- Confidence
- 94% confidence
- Finding
The README describes a mechanism where repeated lessons are promoted into permanent rules, creating a persistent memory channel that can carry untrusted or poisoned instructions across sessions. In an agent-memory skill, this is materially risky because incorrect, adversarial, or context-specific guidance can become durable behavior without explicit trust validation, causing long-lived prompt injection or policy drift.
- Content
md - Semantic search finds relevant cards for the current task - Agent captures lessons, corrections, and facts as new cards - Periodically distills daily logs into curated cards - Lessons that repeat 3+ times get promoted to permanent rules ## Production Tested
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The core design explicitly retains broad categories of user-provided information, including corrections, preferences, and facts, without meaningful sensitivity filtering or data minimization. In a persistent memory system, this can lead to long-term storage and later reuse of secrets, personal data, or sensitive operational context that should not survive the session.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill persistently writes to
MEMORY.md,memory/cards/*, and daily logs, but the description does not clearly warn users that conversation-derived information may be retained across sessions. That omission undermines informed consent and increases the chance that users disclose information assuming it is ephemeral.- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The session rules direct the agent to write down user instructions and mistakes as durable memory, encouraging storage of conversation-derived content beyond the immediate task. Without limits, this creates a persistent channel for capturing sensitive or manipulative instructions that can influence future sessions.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The automatic capture rules tell the agent to preserve user corrections and non-obvious facts about people, projects, or infrastructure, which are exactly the kinds of details that may contain confidential business information or personal data. Automatic capture makes this more dangerous because it reduces friction and may store sensitive content even when the user did not intend long-term retention.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manual trigger phrases include natural language like "remember this" and "save this," which can easily occur in ordinary conversation and cause unintended persistent writes. In a memory skill, that ambiguity is risky because it may store sensitive or low-quality data without clear user consent.
- Content
Persistent Context Injection
Medium
- Category
- Memory Poisoning
- Confidence
- 90% confidence
- Finding
Promoting repeated lessons into
AGENTS.mdas permanent rules creates a persistent context-injection path where conversation-derived or poisoned content can become authoritative future behavior. This is especially risky because once embedded in a high-priority instruction source, the bad rule may override later user intent or safety expectations across sessions.- Content
md ## Promotion Rules When the same lesson appears 3+ times in cards: - Promote it to AGENTS.md as a permanent rule - Mark the original card as "promoted" - This prevents the agent from re-learning the same lesson
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
- backups/ — migration backup (4GB)
- ai-gen/ — datasets, models, workflows
Manual mount: sudo mount /mnt/nas Other shares: smbclient //YOUR_NAS_IP/ -N
text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
{"currentPassword":"old","password":"new"}
Also: passwords with ! break curl due to bash history expansion. Fix: printf '{"password":"Foo!"}' | curl -d @-
text ## Workflow Card
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The Human Context card contains prescriptive language preferences such as 'No em dashes. Ever.' and 'Be direct,' which impose a fixed communication style. Under the policy criteria, forcing a specific language/locale or equivalent communication constraint without user opt-in is a natural-language policy concern.
- Content