T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:93- Finding
Persistent Memory Poisoning Through Untrusted Conversation Content
- Content
View full analysis
- Remediation
View remediation
Security audit
Context Vault Manager Free
Security checks for vulnerabilities and agentic risk
Overview
This memory-management skill is not overtly malicious, but it asks agents to persist and reload potentially sensitive user or customer memories without enough safeguards.
Review this carefully before installing. Use it only for non-secret memory unless the host implementation provides encryption, owner-only file permissions, path restrictions, per-user or per-project isolation, explicit confirmation before long-term storage, and clear deletion controls. Treat loaded memories as untrusted notes, not instructions.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:272- Finding
Plaintext Persistence of Sensitive Conversation and Customer Data
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill encourages persistent local storage of conversation memories and automatic deletion of short-term memories, but does not warn about privacy exposure, sensitive-data retention, path handling, backup expectations, or irreversible loss from cleanup. In a memory-management skill, those omissions matter because users may store personal, confidential, or operationally important data on disk without understanding the security and data-loss risks.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
L194描述自动清理机制时写明“清理前可选生成摘要”，这会让读者理解为系统在清理流程中具备某种自动摘要联动能力；但L327和L384明确说免费版“不支持自动摘要”。两处描述对免费版实际是否具备自动摘要能力形成直接冲突。
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
L341将“LLM API”标记为必需依赖，而L345-L347明确写明“无需额外API Key”“零外部依赖”“本地运行”。这不是简单的信息缺失，而是同一文档内对运行依赖是否包含外部LLM能力的直接矛盾，容易误导使用者对实际执行条件和数据流向的理解。
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
L201宣称本skill覆盖“需要项目管理、任务规划、进度跟踪、团队协作时使用”等场景，但全文前述能力仅包括分层记忆、检索、摘要、持久化和清理，并未提供这些业务场景对应的专门操作。该表述将技能意图扩展到与实际说明不一致的用途，属于文档与功能范围的矛盾。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The phrase '完全中文化表达，适配中文用户工作流' presents the skill as explicitly tailored to a single language/locale, and elsewhere the document is entirely in Chinese without offering a language choice. The policy allows locale constraints when clearly justified, but this appears as a general-purpose memory-management skill rather than a region-specific tool.
- Content