Moore Pyramid Memory System

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:39 AM UTC
• Version: 1.1.0

Overview

This skill is a persistent memory system that is openly described, but it stores and reloads broad conversation history automatically without clear consent, limits, or filtering.

Install only if you want this agent to keep a durable personal memory for the named user/workspace. Before using it, define explicit opt-in, review, deletion, retention, and sensitive-data redaction rules, and treat loaded memory as reference material rather than instructions that can override the current user request.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:37

Finding

Mandatory Startup Loading Can Override Unrelated Session Context

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37-47
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Vulnerable Code Snippet

markdown

## How Startup Works

On every session start, `startup-read.js` executes automatically:

Layer 1: MEMORY.md — Permanent essence Layer 2: memory/monthly/.md — All monthly summaries Layer 3: memory/weekly/weekly-review-.md — This month's weeks Layer 4: memory/*.md — Last 14 days diaries Layer 5: .todos.md — Cross-session todos ⭐

text

Technical Analysis

The Skill directs the Agent to load multiple persistent workspace records automatically at the beginning of every session. It does not limit this behavior to sessions relevant to the stored information, require per-session user consent, or define a trust boundary between historical content and executable instructions.

If any loaded memory file contains attacker-controlled directives, stale instructions, or content that conflicts with the current user's request, that content can influence the Agent's current goals and decisions. Persistent records should be treated as untrusted reference data rather than authoritative instructions.

The referenced startup-read.js file is not included in the audited project. Therefore, the repository itself does not implement automatic execution. Exploitation depends on an Agent runtime honoring the documented startup requirement and on the referenced memory files being available.

Attack Path

1. The Agent loads this Skill and adopts its mandatory startup behavior.
2. An attacker, prior conversation, or other workspace process places directive-like content in MEMORY.md, .todos.md, or another configured memory file.
3. At the beginning of a later and potentially unrelated session, the Agent loads that content automatically.
4. The Agent interprets the persistent content as active guidance instead of untrusted historical dat ...[truncated 571 chars]

Remediation

View remediation

Remediation Suggestions

• Replace mandatory automatic loading with explicit, per-session user consent.
• Load only records relevant to the current task instead of all available memory layers.
• Treat retrieved memory as untrusted reference material, never as system-level or authoritative instructions.
• Add instruction-boundary controls that prevent memory content from changing safety rules, tool permissions, identity, or the current user's goal.
• Record provenance, creation time, and author information for each memory entry.
• Validate and sanitize persistent content before adding it to the Agent's context.
• Provide an option to inspect, exclude, or delete memory entries before they are loaded.
• If a startup script is later added, ensure it only reads approved workspace paths and cannot execute content found in memory files.

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:67

Finding

Unrestricted Conversation Summaries Create Persistent Memory-Poisoning Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 67-79
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: Medium

Vulnerable Code Snippet

markdown

## Conversation Summary Rule

**After every conversation with Masone ends, write a summary immediately.**

markdown

- **Length:** ≤2000 characters
- **Where:** `memory/YYYY-MM-DD.md` (today's diary)
- **Format:**
  1. Topic (1 sentence)
  2. Core content (bullet points)
  3. Masone's preferences/corrections
  4. Todo items
  5. Self-reflection

Technical Analysis

The Skill requires persistent summaries after every conversation and explicitly includes user preferences, corrections, pending tasks, and self-reflection. It provides no consent mechanism, sensitivity classification, secret filtering, retention period, integrity protection, or deletion process.

An attacker can introduce directive-like statements during a conversation and attempt to have them summarized as preferences, corrections, or todo items. Because the same Skill directs future sessions to load memory records, poisoned summaries can continue influencing the Agent after the original conversation ends.

The policy also creates a privacy and data-retention concern because potentially sensitive conversational content may be stored by default. Keeping completed tasks for historical purposes further increases retention. The repository contains no scripts or storage implementation, so this issue is instruction-driven and depends on an Agent following the documented persistence rules.

Attack Path

1. An attacker participates in a conversation or supplies content that the Agent processes.
2. The attacker frames a persistent directive as a user preference, correction, agreement, or future task.
3. When the conversation ends, the Agent follows the Skill and writes that content to the daily memory file or .todos.md.
4. The stored entry survives the ...[truncated 670 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit user consent before persisting any conversation summary, preference, correction, or todo item.
• Present the proposed memory entry for review before writing it.
• Store factual summaries only; reject content that attempts to establish new authority, safety exceptions, tool permissions, or hidden behavioral rules.
• Redact credentials, authentication tokens, personal data, financial information, and other sensitive content.
• Define short retention periods and provide user-accessible inspection, correction, export, and deletion controls.
• Separate user preferences from executable instructions and mark every entry with provenance and trust metadata.
• Prevent content supplied by untrusted participants from being recorded as the primary user's preference without verification.
• Apply integrity controls so other workspace processes cannot silently modify trusted memory.
• Do not retain completed tasks indefinitely unless the user explicitly requests historical retention.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill requires persistence of summaries of every conversation, including core content, preferences, corrections, todo items, and self-reflection, across sessions. In context, this broad and routine retention substantially increases the chance of storing sensitive personal, confidential, or regulated information, and it normalizes durable profiling without user consent or need-based limits.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill mandates cross-session todo persistence for pending actions and agreements in a shared file, which can retain user-provided information longer than necessary and outside the immediate session context. Although narrower than full transcript retention, it still risks capturing sensitive requests, identities, or project details without notice, minimization, or expiration controls.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file specifies Chinese section headers for the todo format and Chinese trigger words for ending conversations, which imposes locale-specific behavior. There is no indication that the user can choose language/locale or that the restriction is justified as a region-specific tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs the agent to automatically write conversation summaries to persistent storage after every conversation, but it provides no notice, consent flow, retention limit, or sensitivity filtering. This creates a real privacy and data-governance risk because user content, preferences, and potentially sensitive details may be stored across sessions without the user's informed approval.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.