Recall Markdown Memory

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:09 AM UTC
• Version: 0.1.0

Overview

This skill is a read-only helper for selecting relevant Markdown memory sections, with a supply-chain caveat if users manually install its unpinned dependency.

Before installing, verify that mdselect is the package you intend to trust and prefer isolated installation such as pipx or uv tool. The skill should only be used for Markdown memory or notes you are comfortable letting the agent read, and its own instructions say not to modify those files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17-23
Vulnerability Type: Unpinned package installation from external registries
Risk Level: Medium

Vulnerable Code

markdown

3. Offer these installation choices:

   ```bash
   pipx install mdselect
   uv tool install mdselect
   python -m pip install mdselect
   ```

Technical Analysis

The skill recommends installing mdselect from external package registries without specifying a reviewed version, validating the package source, or verifying artifact hashes or signatures. Consequently, the package and its transitive dependencies may change after the skill has been reviewed.

The skill explicitly prohibits automatic installation, which limits direct exploitation. Nevertheless, a user who follows one of the suggested commands will install and execute registry-supplied package content. Python package installation can execute build backends and other package-controlled installation logic. A compromised release, compromised transitive dependency, dependency-confusion event, or registry account takeover could therefore introduce attacker-controlled code.

Attack Path

1. An attacker compromises the resolved mdselect package, one of its dependencies, or the associated package-publishing account.
2. A user encounters the missing-dependency instructions and runs one of the documented installation commands.
3. The package manager resolves the current unpinned release from an external registry.
4. Malicious package build or installation logic executes during installation, or malicious runtime logic executes when the skill later invokes mdselect.
5. The payload operates with the privileges of the user or environment running the installation or command.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the installing user's privileges. Depending on that user's access, the attacker could read o ...[truncated 351 chars]

Remediation

View remediation

Remediation Suggestions

• Pin mdselect to a specifically reviewed version rather than resolving the latest available release.
• Provide verified hashes for the package and all locked transitive dependencies, such as through a hash-locked requirements file.
• Identify and validate the official package registry and publisher before recommending installation.
• Prefer isolated installation with pipx or another constrained environment instead of installing into a system or project-wide Python environment.
• Review package metadata, source, build configuration, and dependency graph before updating the pinned version.
• Where supported, require signed provenance or trusted-publisher attestations for downloaded artifacts.
• Retain the existing prohibition against automatic installation and require explicit user approval before executing any package-manager command.

SkillSpector

Vulnerability Patterns

• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md

have changed; verify current facts through an appropriate current source.
- Follow the user's current request and applicable project instructions when
  they conflict with stored memory.
- Never create, edit, reorganize, or delete memory files under this skill.