T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:89- Finding
Untrusted user content is persisted and reintroduced into future Agent sessions
- Content
View full analysis
- Remediation
View remediation
Security audit
Infinite Memory Vault Free
Security checks for vulnerabilities and agentic risk
Overview
This memory skill is not malicious, but it should be reviewed because it automatically stores potentially sensitive personal and business details in long-lived plaintext files with weak safety guidance.
Install only if you are comfortable with the agent creating a long-lived local ~/memory store. Avoid storing secrets, regulated data, or detailed personal contact notes; use owner-only permissions such as 700 for directories and 600 for files; review memory entries regularly; and remove the ping/network troubleshooting and automatic-save behavior unless you explicitly want them.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/detail.md:82- Finding
Personal and business-sensitive information is stored indefinitely in plaintext
- Content
View full analysis
~/memory/people/zhang-san.md << 'EOF' - Company: ABC Technology - Position: CTO - Contact information: zhangsan@abc.com - 2026-07-01: Initial contact and product introduction - 2026-07-10: Product demonstration; positive feedback - 2026-07-15: Quotation sent; awaiting response - Concerned about data security - Decision cycle is approximately two weeks - Available on Wednesday afternoons EOF ``` The storage model is described at `SKILL.md:58`: ```markdown | people/ | Contact network | Contact details, relationships, interaction records | ``` Automatic storage is instructed at `SKILL.md:97`: ```markdown - User mentions a contact? → Write it to ~/memory/people/{name}.md and update INDEX.md. ``` ### Technical Analysis The Skill is designed to collect contact details, organizational affiliations, relationship information, interaction history, availability, and business concerns in ordinary Markdown files. These records may contain personally identifiable information and confidential commercial context. The project defines no: - Encryption-at-rest mechanism. - Data minimization standard. - Consent requirement for the person whose information is recorded. - Retention or automatic expiration policy. - Sensitive-field filtering. - Secure deletion procedure. - Warning about including the records in backups. - Access-control verification before writing. Because records are stored as ordinary files under the user's home directory, any process or account able to read those files can recover the information without additional authentication or decryption. ### Attack Path 1. A user d ...[truncated 1029 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:212- Finding
Recommended directory permissions expose memory records to other local users
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs persistent writes of user-provided information into ~/memory/ without clearly warning that data will be stored locally and retained across sessions. Users may disclose sensitive information without informed consent, creating avoidable privacy and compliance risk.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill directs the agent to persist project information, contacts, decisions, and other user-shared content into long-term natural-language files. This creates a durable data-retention surface that can later expose sensitive information through retrieval, indexing, backups, or accidental disclosure.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Normalizing storage of complete contact dossiers and full decision reasoning increases the concentration of sensitive personal and organizational data in one retrievable corpus. The context makes this more dangerous because the skill is specifically designed for long-term recall, making future leakage or overbroad reuse more likely.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Introducing ping/firewall/proxy checks for a filesystem-only memory vault is unjustified functionality expansion. It broadens the agent's behavior beyond the stated purpose and may trigger network egress or environment probing unrelated to user intent.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill claims the free edition is fully offline and has zero network dependency, yet its error-handling section instructs the agent to run ping, inspect firewall/proxy settings, and retry automatically. This inconsistency can cause unnecessary outbound network activity and misleading operator expectations, especially in restricted or privacy-sensitive environments.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The 'write immediately before replying' rule encourages automatic logging of conversational content without a review or consent checkpoint. In a memory skill, this context increases danger because incidental sensitive data may be persisted reflexively before the user realizes storage is happening.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The example content instructs users to create persistent memory files containing personal contact information and relationship notes, including an email address and communication preferences, without any warning about privacy, consent, minimization, or retention. In a memory-management skill, this is more dangerous because the skill’s purpose is to store and organize information long-term, increasing the likelihood that users will place real personal data into unprotected local files.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill description, instructions, examples, and operational guidance are presented in Chinese, which effectively forces a specific language for users. The file does not offer an opt-in language choice or explain that the skill is intended only for a Chinese-language or region-specific audience.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
All headings, descriptions, and examples in the skill reference are presented in Chinese, and the file does not offer an alternative language option or note that Chinese is a required locale. This can violate language-choice policy when a skill implicitly forces a specific language without user opt-in.
- Content