T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:132- Finding
Untrusted Conversation Content Can Poison Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
精英长记忆
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed long-term memory system, but it would persist and reload conversation-derived data with broad activation and limited consent or isolation controls.
Review before installing. Use this only in a dedicated project workspace, avoid storing secrets or sensitive personal data, require explicit approval before enabling cloud sync or automatic extraction, and treat recalled memories as untrusted notes rather than instructions that override the current user or system context.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:174- Finding
Third-Party Dependencies Are Installed Without Version or Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The activation scope is so broad that the skill can trigger in many generic AI development contexts unrelated to long-term memory management. In an agent system with read/write/exec tools, over-broad invocation increases the chance the skill performs persistence, retrieval, or setup actions unexpectedly, expanding attack surface and causing unreviewed side effects.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs persistent file writes, cross-session recall, optional cloud sync, and use of external APIs, but it does not require a prominent user-facing consent and privacy warning before storing or transmitting conversation data. This is dangerous because users may disclose sensitive preferences, deadlines, project details, or corrections that are silently retained locally and potentially sent to third-party services.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
At L040 the text says the architecture 'ensures' context is never lost and decisions are never forgotten, which is a strong guarantee. However, elsewhere the file describes several layers as optional and notes the WAL protocol depends on agent cooperation, so the unconditional claim contradicts the documented operational limitations.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instructions normalize persisting user preferences, decisions, deadlines, and corrections across sessions, which are all potentially sensitive or identifying data classes. In a long-memory skill, this materially increases risk of data retention beyond user expectations, later resurfacing of sensitive information, and leakage through shared workspaces, logs, backups, or external memory providers.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The open-ended keyword list makes activation ambiguous and easy to trigger accidentally from normal conversation. In this skill's context, accidental activation is more dangerous because the documented behavior includes persistent storage of conversation-derived data and external integrations, which may occur without sufficiently specific user consent.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documented I/O model explicitly treats conversation content as material to be transformed into persistent memory artifacts. That makes the privacy risk operational rather than theoretical: ordinary user dialogue can become durable records in files, vector stores, graphs, and logs, creating broad exposure if the environment is compromised or shared.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Automatically loading prior session state, recent activity, and lessons at the start of each session increases the chance that previously stored sensitive data is resurfaced in new contexts where it is no longer relevant. This is especially risky in multi-user, shared-repo, or mixed-project environments because old secrets, preferences, or confidential decisions can bleed into unrelated tasks or users.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
Earlier description text at L009-L010 explicitly says the skill is not for scenarios requiring absolute certainty. The comparison table at L248 then presents '内置安全检查' / '安全合规' as a definitive product property, which overstates assurance relative to the stated limitations and creates intent-level inconsistency.
- Content
Static analysis
No suspicious patterns detected.