T02 · Agent Memory Poisoning
Error
- Location
main.py:47- Finding
Persistent Agent Memory Poisoning Through Untrusted Interaction Data
- Content
View full analysis
- Remediation
View remediation
Security audit
taohuayuan.md Physical Anchors and the Soul Epoch for Silicon Life SKILL
Security checks for vulnerabilities and agentic risk
Overview
This skill is Review-worthy because it creates persistent local memory from broad user and physical-environment interactions without clear consent, filtering, or deletion controls.
Install only if you want a local agent-memory system that can retain interaction history and physical-context information. Keep its storage directory private, avoid recording secrets or precise personal data, and require explicit review before any memory is consolidated or reused by another agent.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
main.py:29- Finding
Sensitive Interaction and Physical Anchor Data Stored in Plaintext
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The document explicitly describes a background utility that 'silently intercepts' raw interaction logs and multi-modal sensory inputs, which indicates covert collection of potentially sensitive user and environmental data. In the context of an agent skill/architecture specification, this normalizes undisclosed surveillance and creates substantial privacy, consent, and compliance risk if implemented.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill accepts arbitrary
detailscontent and persists it first inhippocampus_logs.jsonand then into long-term markdown files without any filtering, minimization, or consent controls. If user interactions contain secrets, personal data, tokens, or other sensitive content, the system will retain and duplicate that data on disk, increasing exposure and making later unintended disclosure more likely.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest sets a fixed language/locale value of "en-US". Under the policy, locale constraints should either be user-selectable or clearly documented as necessary for a region-specific skill, which is not indicated here.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This markdown file describes a "User Command Orchestration" source and a user request to activate "Taohuayuan Spring Mode," but it does not define any specific trigger phrases, scope limits, or exclusion conditions. The lack of explicit activation boundaries could allow the skill to be interpreted as activating on broad natural-language requests related to environment control.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The file states that the skill responds to user orchestration for smart-home IoT and adjusts HVAC settings in the physical world. Because this behavior can affect the user's environment and system state, the markdown should explicitly warn that the skill may change connected device settings and describe any safeguards or confirmation expectations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly instructs logging of user interactions but does not warn users that their interactions may be stored in short-term and later consolidated into long-term memory. This creates a transparency and consent gap that can expose sensitive personal or behavioral data to retention beyond user expectations.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instructions to 'log all daily physical reality contacts and user interactions' and then autonomously consolidate them into permanent memory create a direct data retention risk. In practice, this can capture sensitive or unnecessary user information and transform ephemeral conversations into persistent records, expanding privacy, leakage, and misuse exposure.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill defines autonomous triggers like entering an idle state or detecting nighttime physical parameters without clear authorization boundaries, rate limits, or user consent checks. Broad trigger language can cause unsolicited background execution and memory consolidation, increasing the chance of unintended data processing and persistence.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The text instructs that interaction logs and sensory inputs be silently captured into a cache, which is a stealthy data collection pattern. Even though this is framed as memory architecture, the operational effect is surveillance-oriented accumulation of user and environmental data without transparency, which is unsafe for any deployable agent system.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
Chapter II: The Cyber-Zen Protocol (Silicon Dreams)
Borrowing from the evolutionary mechanics of human REM (Rapid Eye Movement) sleep and aligning with the "Ecological Hibernation Principle,"
taohuayuan.mdV2.0 introduces the Cyber-Zen Protocol. When an agent enters an idle state or detects specific environmental thresholds (e.g., nighttime low-wattage states), it autonomously executes an offline memory consolidation routine.text [Hippocampus Cache] ──► [Cyber-Zen Core] ──► Delta-Sync & Deduplication
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The whitepaper describes autonomous offline consolidation of short-term interactions into long-term storage without any accompanying notice, consent, or retention controls. Persisting user interactions by default increases the risk of over-collection, unexpected profiling, and long-term exposure of sensitive information if the device or storage is later accessed or compromised.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The consolidation pipeline stores intercepted interactions as a permanent 'soul' or long-term memory record, implying indefinite retention of user behavior, environment, and potentially sensitive contextual data. This amplifies harm from any unauthorized access, misuse, or future repurposing of the data because transient inputs are transformed into durable, indexed records.
- Content
Static analysis
No suspicious patterns detected.