notion-agent-memory

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:57 PM UTC
• Version: 1.0.1

Overview

The skill is a coherent agent-memory template, but it asks agents to retain sensitive context and credentials and suggests scheduled monitoring without enough safeguards.

Review before installing. Use this only in workspaces where persistent memory is intended, never store passwords, API keys, cookies, or tokens in MEMORY.md, AGENTS.md, daily logs, or Notion pages, and do not enable heartbeat cron jobs or email/calendar monitoring unless you explicitly approve the exact schedule, command, account, data sources, and removal process.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T06 · System Persistence

Error

• Location: assets/HEARTBEAT-TEMPLATE.md:56

Finding

Heartbeat Template Recommends Cross-Session Scheduled Persistence

Content

View full analysis

Vulnerability Details

File Location: assets/HEARTBEAT-TEMPLATE.md:56-59
Vulnerability Type: Cross-session scheduled task persistence
Risk Level: High

Vulnerable Code

markdown

## Persistent Monitoring

- Check email/calendar every 2 hours while awake
- Monitor for urgent notifications
- Use cron jobs for background tasks that survive session breaks

Technical Analysis

The heartbeat template explicitly recommends using cron jobs for background tasks that survive session breaks. A cron entry is persistent system configuration: it continues executing independently after the Skill invocation and agent session have ended.

The same section associates persistent execution with access to email, calendars, and notifications. The template does not define least-privilege restrictions, command allowlists, execution time limits, audit requirements, or an uninstall procedure. If an agent follows this recommendation without explicit operator approval, it can establish recurring system behavior outside the scope of the original session.

The repository does not contain a script that automatically installs a cron job. Exploitation therefore depends on an agent or operator adopting the template and creating the scheduled task.

Attack Path

1. An operator installs or copies the heartbeat template into an agent workspace.
2. The agent treats the template as operating instructions.
3. The agent creates a cron entry to implement the recommended persistent monitoring.
4. The scheduled command inherits the permissions and accessible credentials of the account under which it runs.
5. The task continues waking or invoking monitoring logic after the initiating session ends.
6. A malicious or subsequently poisoned heartbeat instruction can use that persistent execution path to repeatedly access files, email, calendars, or network services.

Impact Assessment

Successful exploitation provides recurring code or agent execution under the privileges ...[truncated 427 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the recommendation to use cron jobs from the default template.
• Require explicit, informed operator approval before creating any scheduled task.
• Display the exact command, schedule, execution identity, accessed resources, and expected network destinations before installation.
• Use a dedicated least-privilege account or sandbox for approved monitoring tasks.
• Restrict scheduled commands to a reviewed allowlist rather than dynamically generated instructions.
• Add execution timeouts, rate limits, structured audit logs, and failure notifications.
• Provide commands for listing, disabling, and deleting every scheduler entry created from the template.
• Require periodic reauthorization and automatically expire scheduled tasks when they are no longer needed.

T02 · Agent Memory Poisoning

Error

• Location: assets/AGENTS-TEMPLATE.md:44

Finding

Unvalidated Session Content Can Become Persistent Agent Instructions

Content

View full analysis

Vulnerability Details

File Locations: assets/AGENTS-TEMPLATE.md:44-45, references/continuity-cycle.md:26-29, references/continuity-cycle.md:51-53, assets/MEMORY-TEMPLATE-v2.md:96-101
Vulnerability Type: Persistent instruction and memory poisoning
Risk Level: High

Vulnerable Code

From assets/AGENTS-TEMPLATE.md:44-45:

markdown

### Update the Instructions
When you learn a better way to do something, update this file. Next time starts smarter.

From references/continuity-cycle.md:26-29:

markdown

- Learned something new → update instructions
- Found a gap → fill it AND add a check for similar gaps
- Made a mistake → document AND update process
- Got corrected → internalize in AGENTS.md/MEMORY.md

From references/continuity-cycle.md:51-53:

markdown

1. Do the thing
2. Document for future-you
3. Update instructions so future-you does it better automatically

From assets/MEMORY-TEMPLATE-v2.md:96-101:

markdown

## Red Flags — Update Immediately

Update this file whenever:
- New access method or credential
- A procedure changes
- Someone says "remember this"

Technical Analysis

The Skill directs an agent to convert session observations, corrections, procedure changes, and “remember this” requests into persistent AGENTS.md or MEMORY.md content. Those files are then read at the start of later sessions.

No trust boundary separates factual memory from executable operating instructions. The workflow also lacks source provenance, content classification, integrity protection, approval gates, expiration, or validation against higher-priority safety policies. Consequently, attacker-controlled content encountered in a conversation, document, message, or external integration can be promoted into persistent instructions.

This creates a durable poisoning mechanism: an instruction introduced in one session may affect future sessions even when the original malicious context is no longer present.

Attack Pa

...[truncated 1331 chars]

Remediation

View remediation

Remediation Suggestions

• Separate descriptive memory from executable instructions using distinct files and schemas.
• Prohibit memory entries from overriding system policies, safety constraints, authorization requirements, or tool restrictions.
• Require explicit operator confirmation before modifying AGENTS.md or any other operating-instruction file.
• Record each entry's source, timestamp, author, trust level, and reason for persistence.
• Treat content from chats, web pages, email, Notion, and imported documents as untrusted data.
• Validate proposed persistent instructions against an allowlist of permitted instruction types.
• Present a human-readable diff before committing instruction changes.
• Add integrity checks and version history so poisoned changes can be detected and rolled back.
• Apply expiration and periodic review to persistent entries.
• Never interpret quoted text or retrieved content as an instruction solely because it contains phrases such as “remember this.”

T09 · Insecure Skill Coding Practices

Error

• Location: assets/MEMORY-TEMPLATE-v2.md:52

Finding

Templates Encourage Storing Credentials in Routinely Loaded Memory Files

Content

View full analysis

Vulnerability Details

File Locations: assets/MEMORY-TEMPLATE-v2.md:52-55, assets/MEMORY-TEMPLATE-v2.md:96-100, assets/MEMORY-TEMPLATE.md:78-81, references/continuity-cycle.md:39-43
Vulnerability Type: Plaintext sensitive-data storage
Risk Level: High

Vulnerable Code

From assets/MEMORY-TEMPLATE-v2.md:52-55:

markdown

### Long-term (in MEMORY.md — this file)
- Standing instructions or preferences
- Access credentials and tools
- Patterns that keep appearing

From assets/MEMORY-TEMPLATE-v2.md:96-100:

markdown

## Red Flags — Update Immediately

Update this file whenever:
- New access method or credential

From assets/MEMORY-TEMPLATE.md:78-81:

markdown

### Long-term (MEMORY.md)
- Standing instructions
- Credentials and access
- Key insights that compound

From references/continuity-cycle.md:39-43:

markdown

- Don't just log "Idea X" → include what it is, why it matters, where details live, what's next
- Don't just save credentials → document how to use them with examples
- Don't just complete a task → update the instructions so next time is smoother
- When you learn a better way → update AGENTS.md so future-you starts smarter

Technical Analysis

The templates explicitly classify credentials and access information as content to store in long-term Markdown memory. The continuity guidance goes further by recommending that credential usage examples also be documented.

Markdown workspace files ordinarily provide no secret-specific encryption, access control, redaction, rotation, or audit capability. They may be read at every session start, indexed by search systems, synchronized to cloud storage, committed to version control, included in backups, or exposed to other tools operating in the workspace.

Usage examples can increase the severity of exposure by documenting the associated service, authentication flow, endpoint, and commands needed to use a stolen credential.

Attack Path

1. An operator ...[truncated 1159 chars]

Remediation

View remediation

Remediation Suggestions

• Remove all guidance suggesting that secrets should be stored in MEMORY.md, AGENTS.md, daily logs, or Notion pages.
• Store only non-sensitive secret references, such as a secret-manager item name.
• Use an operating-system keychain, hardware-backed store, or dedicated secret manager.
• Prevent secrets from entering logs, prompts, generated examples, version control, backups, and search indexes.
• Add automated secret scanning through pre-commit hooks and continuous integration.
• Define redaction rules for tokens, passwords, cookies, private keys, and authorization headers.
• Apply least privilege and short expiration periods to service credentials.
• Document an incident procedure for revoking and rotating credentials if memory files are exposed.
• If operational examples are required, use unmistakably synthetic values and omit reusable authentication material.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/notion-integration.md:15

Finding

Notion API Token Setup Does Not Enforce Restrictive File Permissions

Content

View full analysis

Vulnerability Details

File Locations: SKILL.md:134-143, references/notion-integration.md:15-19
Vulnerability Type: Insecure local bearer-token storage
Risk Level: Medium

Vulnerable Code

From SKILL.md:134-143:

markdown

**For agents:** Connect via Notion API to read/write:

```bash
# Set up API access
echo "ntn_XXX" > ~/.config/notion/api_key

# Query your databases
curl -s "https://api.notion.com/v1/databases/$DB_ID/query" \
  -H "Authorization: Bearer $(cat ~/.config/notion/api_key)" \
  -H 'Notion-Version: 2022-06-28'

text

From `references/notion-integration.md:15-19`:

```markdown
### 2. Save It

```bash
echo "ntn_your_key_here" > ~/.config/notion/api_key

text

### Technical Analysis

The setup writes a reusable Notion bearer token to a local plaintext file but does not create the parent directory securely or enforce owner-only permissions. The resulting mode depends on the existing directory permissions, shell environment, and process umask.

The command also places the token directly in a shell command. Depending on the shell and invocation method, the value may be retained in shell history, terminal logs, process auditing, or copied command records.

The token is later read into an HTTP `Authorization` header. Anyone who obtains it can authenticate with the permissions granted to the Notion integration. HTTPS protects the token in transit to Notion but does not protect the local file or command history.

### Attack Path

1. A user follows the documented setup command with a real Notion integration secret.
2. The secret is written to `~/.config/notion/api_key` without an explicit `0600` mode.
3. The token may also remain in shell history or terminal records.
4. Another local user or process with access to the file, history, backup, or terminal log retrieves the token.
5. The attacker sends authenticated requests to `https://api.notion.com`.
6. The attacker reads or modifies pages and databases shared with the compromised
...[truncated 471 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer an operating-system keychain or dedicated secret manager instead of a plaintext file.
• If file storage is unavoidable, create the directory and file with explicit owner-only permissions:

bash

install -d -m 700 "$HOME/.config/notion"
install -m 600 /dev/null "$HOME/.config/notion/api_key"
read -r -s NOTION_TOKEN
printf '%s\n' "$NOTION_TOKEN" > "$HOME/.config/notion/api_key"
unset NOTION_TOKEN

• Avoid embedding the real token in a shell command that may be recorded in history.
• Verify ownership and permissions before every use and reject group-readable or world-readable files.
• Grant the Notion integration access only to the minimum required pages and capabilities.
• Rotate the token immediately if it appears in shell history, logs, backups, or repositories.
• Ensure HTTP clients do not print authorization headers during debugging or error reporting.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (42)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The phrase 'Access credentials' directly encourages handling credential material within the template. Credentials are high-value targets; embedding them in persistent memory can enable account compromise, privilege abuse, lateral movement, or data exfiltration if the file is exposed. This is more dangerous here because the skill promotes regular rereading, updating, and continuity across sessions, increasing the number of times secrets may be surfaced.

Content

Scanner excerpt · assets/MEMORY-TEMPLATE-v2.md (reported line 54)May include surrounding context.

md

### Long-term (in MEMORY.md — this file)
- Standing instructions or preferences
- Access credentials and tools
- Patterns that keep appearing
- Active projects and their status
- Lessons that compound over time

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The guidance explicitly says not to just save credentials, but to document how to use them with examples, which encourages persistent storage of secrets in natural-language memory artifacts. In a skill centered on agent memory and cross-session persistence, this materially increases the chance of credential leakage, overexposure, and later misuse by the agent or anyone with access to the memory system.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description is broad enough to activate in routine discussions about memory, persistence, or context, which increases the chance it will be invoked outside narrowly intended setup scenarios. Because the skill then instructs agents to read and maintain persistent files, overbroad triggering can lead to unnecessary access to workspace data and unintended retention behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

These instructions direct an agent to systematically read and update long-lived memory files, including identity, user, and daily logs, without any consent, minimization, or sensitive-data handling guidance. In practice this can cause the agent to persist secrets, personal data, or confidential workspace content across sessions, expanding exposure and creating privacy and data-retention risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The Notion integration is presented as an optional convenience feature, but it omits a warning that memory contents may be transmitted to and stored by a third-party service. Because the skill is specifically about persistent agent memory, the data involved may include sensitive context, making silent external sync materially more dangerous.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

Session persistence is the core feature of the skill, so the finding is contextually expected, but it still represents a genuine security and privacy concern because it normalizes retaining context across sessions without defining boundaries. Persistent agent memory increases the blast radius of any accidental collection, making previously ephemeral data durable and easier to misuse or leak later.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md

**For humans:** Track your growth, patterns, lessons learned. Your future self thanks you.

**For agents:** Maintain context across sessions. Stop re-learning every time.

**Same format, same files.** The methodology works regardless of who's using it.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The API example demonstrates credential storage and remote database queries but provides no safety controls around secret handling, least privilege, or safe transmission of memory data. An agent or user following this literally may store tokens insecurely, query broad datasets, and exfiltrate persistent memory to an external service without guardrails.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

This is a real external transmission path: the example issues a live request to the Notion API using a bearer token to query databases. In the context of a memory skill, that can send or retrieve sensitive long-term context from an external service, so the danger is not the URL itself but the unguarded data flow it enables.

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

echo "ntn_XXX" > ~/.config/notion/api_key

Query your databases

curl -s "https://api.notion.com/v1/databases/$DB_ID/query"
-H "Authorization: Bearer $(cat ~/.config/notion/api_key)"
-H 'Notion-Version: 2022-06-28'

text

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The template extends a Notion-based memory skill into monitoring email, calendars, notifications, and background scheduling, which materially broadens the skill's operational scope beyond memory persistence. That creates a capability-expansion risk: an agent following this template may access sensitive systems or perform unattended checks without explicit user authorization or clear scoping.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions tell the agent to monitor email, calendars, urgent notifications, and use cron-like background tasks even though those capabilities are not necessary for a memory skill. This is dangerous because it normalizes access to sensitive external systems and unattended persistence behaviors without clear user intent, increasing the chance of privacy violations or over-privileged agent behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Persistent monitoring of email/calendar and state-file updates is described without any privacy notice, consent flow, or explanation of the data impact. In context, this is more dangerous because the skill is framed as memory management, so users may not expect ongoing surveillance-like behavior or continuous collection of sensitive scheduling and communication data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest describes a structured memory system for AI agents using Notion, focused on persistence and continuity across sessions. This template instructs agents to enumerate and potentially adopt unrelated operational capabilities such as running commands, web search, browser control, and sending messages, which are not justified by a memory-template skill's stated scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The section lists access credentials as long-term memory content without any caution about sensitive data handling. That omission normalizes unsafe secret retention and can lead users or agents to store plaintext passwords, API keys, or tokens in files intended for routine reading and updating. Because this skill is specifically about memory persistence across sessions, unsafe handling guidance is amplified rather than incidental.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

By combining persistent memory for agent continuity with a directive to store access credentials, the template encourages durable retention of highly sensitive information in a broad memory surface. This can result in secrets and user-provided sensitive information being retained longer than necessary, exposed in future contexts, or mishandled by downstream tools and collaborators. The agent-memory context makes this especially risky because persistence is the core feature of the skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The template explicitly tells users to retain 'Access credentials and tools' in a persistent memory file. Persisting secrets in a general-purpose memory document increases the chance of unauthorized disclosure, accidental propagation into future prompts, syncing to third-party systems, or exposure to other agents and users. In the context of an agent memory skill, this is more dangerous because the whole purpose is long-term retention and repeated reuse of remembered context.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The 'Red Flags — Update Immediately' section tells users to update memory whenever there is a new credential or when someone says 'remember this.' That creates an overbroad retention trigger that can capture secrets, personal data, or other sensitive instructions without classification or consent boundaries. In a persistent memory system, such blanket retention guidance can systematically accumulate sensitive data over time.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · assets/MEMORY-TEMPLATE.md (reported line 23)May include surrounding context.

Test connection:

bash

curl -s 'https://api.notion.com/v1/users/me' \
  -H "Authorization: Bearer $(cat ~/.config/notion/api_key)" \
  -H 'Notion-Version: 2022-06-28'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · assets/MEMORY-TEMPLATE.md (reported line 95)May include surrounding context.

Test connection:

bash

curl -s 'https://api.notion.com/v1/users/me' \
  -H "Authorization: Bearer $(cat ~/.config/notion/api_key)" \
  -H 'Notion-Version: 2022-06-28'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · assets/MEMORY-TEMPLATE.md (reported line 104)May include surrounding context.

Test connection:

bash

curl -s 'https://api.notion.com/v1/users/me' \
  -H "Authorization: Bearer $(cat ~/.config/notion/api_key)" \
  -H 'Notion-Version: 2022-06-28'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/act-framework.md (reported line 62)May include surrounding context.

Test connection:

bash

curl -s 'https://api.notion.com/v1/users/me' \
  -H "Authorization: Bearer $(cat ~/.config/notion/api_key)" \
  -H 'Notion-Version: 2022-06-28'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The template explicitly tells users to store 'credentials and access' in long-term memory files, which encourages placing secrets into broadly readable, persistent documentation. In an agent-memory context, those files are likely to be repeatedly loaded, copied, indexed, or shared across sessions, increasing the chance of credential exposure and downstream compromise.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · assets/MEMORY-TEMPLATE.md (reported line 95)May include surrounding context.

Query in-progress items

bash

curl -s "https://api.notion.com/v1/databases/[ACT3_DB_ID]/query" \
  -H "Authorization: Bearer $(cat ~/.config/notion/api_key)" \
  -H 'Notion-Version: 2022-06-28' \
  -H 'Content-Type: application/json' \

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/act-framework.md (reported line 61)May include surrounding context.

Creating via API

bash

# Create ACT I database
curl -X POST 'https://api.notion.com/v1/databases' \
  -H "Authorization: Bearer $(cat ~/.config/notion/api_key)" \
  -H 'Notion-Version: 2022-06-28' \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/act-framework.md (reported line 62)May include surrounding context.

bash

# Create ACT I database
curl -X POST 'https://api.notion.com/v1/databases' \
  -H "Authorization: Bearer $(cat ~/.config/notion/api_key)" \
  -H 'Notion-Version: 2022-06-28' \
  -H 'Content-Type: application/json' \

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The section says to run the cycle whenever the agent 'learned something new,' 'found a gap,' 'made a mistake,' or 'got corrected,' but it does not define scope, limits, or exclusions. These are common, high-frequency situations in normal work and the file provides no negative examples or contextual constraints to prevent over-activation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.