Agent Memory Persistent Workspace Memory System

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:45 PM UTC
• Version: 1.0.0

Overview

This skill is not overtly malicious, but it should be reviewed because it turns editable workspace memory files into persistent agent instructions and stores personal/project context with limited safety boundaries.

Install only if you are comfortable with the agent keeping persistent Markdown memory in the workspace. Review and edit the startup protocol before use: treat HANDOFF.md, daily logs, and MEMORY.md as untrusted notes, do not store secrets or sensitive personal data, and require confirmation before acting on remembered instructions that run commands, change files, access credentials, delete data, or contact external services.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: QUICKSTART.md:133

Finding

Mutable Workspace Files Are Promoted to Trusted Persistent Agent Instructions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · QUICKSTART.md (reported line 1)May include surrounding context.

md

# QUICKSTART — Agent Memory in 20 Minutes

Your agent forgets everything between sessions. This guide gets it remembering in 20 minutes.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · init_memory.py (reported line 192)May include surrounding context.

python

parser.add_argument("--agent", default=None, help="Agent name")
    parser.add_argument("--user", default=None, help="User/human name")
    parser.add_argument("--timezone", default=None, help="Timezone (e.g. America/New_York)")
    parser.add_argument("--overwrite", action="store_true", help="Overwrite existing files")
    parser.add_argument("--non-interactive", action="store_true", help="Use defaults without prompting")
    args = parser.parse_args()

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document directs the agent to update MEMORY.md with important decisions, lessons learned, and key facts about the user, then later use that information across sessions. This creates a persistent natural-language repository of personal and contextual data that can be exposed through later summaries, prompt injection, mis-scoped reads, or accidental sharing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The guide explicitly tells the agent to automatically write and update persistent memory files with session content, decisions, and user facts, but it does not pair this with clear privacy, consent, retention, or access-boundary warnings. In a memory skill, this creates a real risk of over-collection and long-lived storage of sensitive personal or project data that may later be surfaced unintentionally.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide instructs the agent to keep ongoing daily logs and long-term memory containing session content, decisions, lessons, and discovered user facts. In the context of a persistence skill, this broad retention materially increases the attack surface for privacy leakage, cross-session exposure, and accidental inclusion of secrets or confidential project details.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill describes file read/write behavior and instructs users to run a setup script, but it does not declare any explicit tool scope or permission boundaries. In an agent ecosystem, undeclared filesystem capabilities reduce transparency and can let a skill obtain broader file access than a user expects, especially because it is designed to persist and reload context automatically.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This section explicitly tells the agent to read, reuse, and persist prior-session content across future interactions, including user profile and long-term memory files. Persistent cross-session retention can expose sensitive user data, preserve secrets longer than intended, and create privacy boundary failures if the memory files are later accessed in the wrong context or by another agent/session.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The daily log guidance instructs the agent to keep raw records of session content, which is riskier than curated summaries because raw notes often include sensitive details, confidential prompts, and incidental personal data. Storing these logs daily increases the blast radius of any accidental disclosure, workspace compromise, or context-mixing error.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction to load this memory file 'when people are mentioned' is overly broad and can trigger on routine conversation, causing unnecessary retrieval of sensitive relationship or trust-context data. In a persistent memory system, this increases the chance of inappropriate context injection, privacy leakage, and cross-topic contamination even if cross-channel isolation exists elsewhere in the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The handoff workflow instructs the agent to read, archive, and then clear HANDOFF.md automatically, but the user-facing guidance does not prominently warn that startup behavior will modify and relocate file contents. This can cause unexpected data movement or loss of ephemeral task state, especially if users assume HANDOFF.md is read-only until they manually manage it.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: README.md:23

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: SKILL.md:55