Failure Memory Log

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:08 AM UTC
• Version: 1.0.0

Overview

This skill openly creates a local failure-memory log, but it is broad and automatic enough to persist sensitive error details without clear redaction, consent, or tight recall boundaries.

Install only if you are comfortable with the agent keeping a durable local troubleshooting log. Keep the memory directory outside source control, review it periodically, delete stale entries, and avoid recording raw credentials, tokens, authorization headers, signed URLs, private keys, personal data, or proprietary incident details. Prefer explicit user approval before automatic logging or recall in sensitive projects.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:33

Finding

Persistent Recall of Unsanitized Failure Content Enables Memory Poisoning

Content

View full analysis

- **Category:** - **Context:** - **Error:** `` - **Root Cause:** - **Resolution:** - **Prevention:** - **Tags:** ``` ``` ```markdown Record AUTOMATICALLY when: - A shell command exits non-zero and you identify why - An API call fails and you find the cause - A config/setup step fails and you resolve it - You catch yourself repeating a previously-solved mistake - A sub-agent reports an error with resolution ``` ```markdown **Before starting any significant task**, search failures for relevant history: ```bash grep -i "" memory/failures.md ``` Or use `memory_search` if vector search is available: ``` memory_search query=" failure error" ``` ``` ### Technical Analysis The Skill instructs the agent to persist exact error messages, task context, and generated remediation guidance and then recall that content before later tasks. No validation, escaping, provenance tracking, trust boundary, or instruction/data separation is defined. Error messages and sub-agent reports can contain attacker-controlled text. For example, a remote service, repository fixture, build tool, or malicious sub-agent could return an error containing instruction-like content. Because the Skill directs the agent to record exact errors automatically, that content can enter the persistent failure log. Subsequent searches or failure-report operations expose the stored content to the agent again. The vulnerability ...[truncated 1544 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/init.sh:9

Finding

Sensitive Failure Data Is Stored Without Mandatory Redaction or Restrictive Permissions

Content

View full analysis

- **Category:** - **Context:** - **Error:** `` - **Root Cause:** - **Resolution:** - **Prevention:** - **Tags:** ``` ``` The initializer creates the directory and file without setting explicit private permissions: ```bash MEMORY_DIR="${1:-./memory}" mkdir -p "$MEMORY_DIR" FAILURES_FILE="$MEMORY_DIR/failures.md" if [ -f "$FAILURES_FILE" ]; then echo "✅ $FAILURES_FILE already exists ($(grep -c '^## \[' "$FAILURES_FILE" 2>/dev/null || echo 0) entries)" exit 0 fi cat > "$FAILURES_FILE" << 'EOF' # Failure Memory > Append-only log of failures, root causes, and resolutions. > Search with `grep -i "" memory/failures.md` --- EOF ``` ### Technical Analysis Command and API errors frequently contain sensitive information such as access tokens, authorization headers, signed URLs, database connection strings, usernames, internal hostnames, personal data, and private filesystem paths. The Skill explicitly encourages recording the exact error and related context but provides no redaction policy. The initialization script relies on the caller's existing `umask`. Consequently, the resulting directory and file may be readable by other local users or processes when executed under a permissive environment. The log is also ordinary plaintext and may be accidentally committed to source control, included in backups, or copied into diagnostic bundles. ...[truncated 1407 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger list is broad enough to activate on common phrases like 'what went wrong' or any generic error/failure during normal agent work, which can cause the skill to run unexpectedly. That increases the chance of unsolicited file reads/writes and automatic persistence of task context that the user did not explicitly request.

Content

No source excerpt is available for this finding.

Docker Socket Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md

## Best Practices

1. **Be specific** — "EACCES on /var/run/docker.sock" beats "permission error"
2. **Include the exact error** — Future grep depends on it
3. **Tag generously** — More tags = better recall
4. **Review monthly** — Patterns reveal systemic issues

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly instructs the agent to store exact error messages, detailed context, root causes, and resolutions in a plain markdown log, and later summarize that content. Error messages and task context often contain secrets, tokens, file paths, personal data, internal hostnames, or proprietary details, so this creates a durable disclosure channel and amplifies later leakage through reports and recall.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The instruction to search failure history before 'any significant task' is ambiguous and overly expansive, encouraging the agent to perform unsolicited memory lookups across a wide range of work. In context, this can expose previously stored sensitive operational details and create unnecessary cross-task data access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.