T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:154- Finding
Untrusted User Content Can Poison Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
Memory Fortress Free
Security checks for vulnerabilities and agentic risk
Overview
This memory skill is related to its stated purpose, but it asks for broad persistent memory behavior with weak user control and contains unsafe setup and maintenance commands.
Review carefully before installing. This skill is not clearly malicious, but it is designed to retain and reuse conversation context across sessions and includes commands that can execute local scripts, install third-party packages, sync or expose memories through external services, and delete stored vector memory. Only use it with explicit consent, verified helper scripts, local-only settings unless cloud sync is intended, and backups before any cleanup command.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)
T07 · Tool Hijacking and Spoofing
Error
- Location
SKILL.md:122- Finding
Relative Execution of a Missing memory.py Script Enables Local Tool Spoofing
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:82- Finding
Unpinned npm Dependency Installation Creates a Supply-Chain Execution Risk
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:274- Finding
Destructive Vector Database Deletion Lacks Confirmation and Recovery Safeguards
- Content
View full analysis
memories.json ``` ### Technical Analysis The maintenance instructions use `rm -rf` to recursively and forcibly delete the Agent's vector database. The deletion is presented before the export command and lacks: - A mandatory backup. - Interactive confirmation. - Validation of the resolved target path. - A dry-run mode. - A check that the service has stopped using the database. - A restoration procedure. Although the path is not directly constructed from user input, an Agent may execute the command in response to broad maintenance or troubleshooting requests. The ordering also means the suggested export occurs only after deletion, when relevant data may already be unavailable. ### Attack Path 1. A user, attacker, or poisoned memory entry persuades the Agent to perform the documented maintenance sequence. 2. The Agent executes `rm -rf ~/.agent/memory/vectordb/`. 3. The vector database and its contents are recursively deleted without confirmation. 4. The gateway is restarted. 5. Stored semantic memory becomes unavailable and may be irrecoverable if no external backup exists. ### Impact Assessment Successful exploitation causes data loss and denial of memory functionality for the affected user account. The scope is limited to the specified Agent vector-database directory under the user's home directory, assuming normal path resolution and no unusual filesystem links. The command does not grant additional privileges or execute attacker-supplied code. Its primary impacts are loss of persistent context, degraded Agent behavior, interrupted service, and potential loss of sensitive historical records that have not been backed up. ]]>- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The skill includes an executable destructive command,
rm -rf ~/.agent/memory/vectordb/, in a routine maintenance block. In an agent skill with exec permission, this materially increases the chance of unauthorized or accidental deletion of persisted memory state, especially if run automatically or without path validation.- Content
bash memory_recall query="*" limit=50 rm -rf ~/.agent/memory/vectordb/ agent gateway restart python3 memory.py -p . export --format json > memories.json
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The skill includes an executable destructive command,
rm -rf ~/.agent/memory/vectordb/, in a routine maintenance block. In an agent skill with exec permission, this materially increases the chance of unauthorized or accidental deletion of persisted memory state, especially if run automatically or without path validation.- Content
bash memory_recall query="*" limit=50 rm -rf ~/.agent/memory/vectordb/ agent gateway restart python3 memory.py -p . export --format json > memories.json
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The description and the entire skill content are written as Chinese-only guidance, and later text emphasizes full Chinese localization for the workflow. There is no indication that users can opt into another language or that the locale restriction is required for compliance or region-specific operation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill directs automatic persistence of context, decisions, and preferences to local files as a default behavior without a clear user-facing retention notice. Because the stored material is natural-language conversation state, it can easily include sensitive or personal information the user did not expect to be retained.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill markets itself as a free/local memory solution, yet the same document instructs use of cloud backup and Mem0 external services. This inconsistency can mislead operators into enabling external data egress paths they did not expect, especially when the skill handles persistent user context and preferences.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill promotes long-term logging, cloud backup, and automatic fact extraction from conversations, all of which expand collection beyond immediate task needs. In a memory-management skill, this context makes the risk more serious because the intended behavior is systematic aggregation and reuse of user data over time.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The agent instructions explicitly require persistent storage of user details, preferences, corrections, and decisions across conversations by default. This creates a substantial privacy and data leakage risk because sensitive user information may be retained indefinitely and later surfaced to the wrong task, user, or integration.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instruction to 'silently' store important decisions in Git-Notes normalizes background retention without user awareness. Silent storage is particularly risky here because Git-backed notes may be synchronized, versioned, or shared, making accidental disclosure harder to detect or undo.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The examples normalize comprehensive cross-session recording of user inputs, decisions, and preferences in multiple stores. Multi-store persistence increases attack surface and the likelihood of over-retention, correlation, and accidental disclosure through search, sync, exports, or repository history.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The maintenance section includes a destructive deletion command that removes the vector database without an explicit warning, confirmation step, or backup guidance. An agent following the recipe could irreversibly delete retained memory and operational state, causing data loss or service disruption.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The FAQ says vector search, Mem0, and cloud backup are pro-only, while earlier sections present commands and setup steps as if they are usable now. This mixed messaging increases the chance an agent or user will configure unsupported external integrations and expose memory data unintentionally.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file states the free version does not involve external API calls, but elsewhere documents API-key-driven cloud backup and Mem0 usage. That contradiction undermines informed consent and can cause unexpected transmission of retained conversation data to third-party services.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The document explicitly suggests storing contact information and using optional cloud synchronization, but it does not warn users about handling personal data, access control, retention, or the risk of syncing sensitive memory content to third-party services. In a memory-management skill, this increases the chance that users persist PII or confidential project data without understanding exposure risks.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Natural-language policy issues apply to all file types, including markdown. This file presents all instructional content in Chinese and does not provide an opt-in, alternative language, or justification for a Chinese-only experience, which can be a language/locale policy violation.
- Content