agent-cognitive-states

• Outcome: Review
• Latest audit: Aug 5, 2026 · 8:02 PM UTC
• Version: 0.1.1

Overview

The skill is coherent and not malicious, but it gives agents broad persistence, logging, background monitoring, and skill-patching instructions without enough user control or data-handling limits.

Review this skill before installing in environments with sensitive chats, shared machines, or autonomous agents. If used, require explicit user approval before memory writes, file logging, cron deployment, subagent delegation, or skill patching; also redact secrets and set retention and file-permission limits for any logs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The instruction to 'patch the skill immediately' grants a self-monitoring skill an implicit self-modification capability that exceeds observation/reporting. In an agent environment with write access, this can cause unauthorized prompt or skill changes, create persistence of bad edits, and turn transient errors into lasting behavioral modifications without user review.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The passive logging example writes cognitive-state data to a local file without addressing data minimization, retention, permissions, or the possibility that the log may contain sensitive workflow metadata. In practice, this can leak user behavior, task context, timing, or internal agent state to other local users, backup systems, or later processes.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The template explicitly configures persistent logging of detailed agent cognitive-state reports to a local file, which can retain sensitive operational metadata such as failure counts, token usage, and degraded-state signals. While this is not inherently malicious, storing these reports without retention limits, access controls, or sensitivity warnings increases the risk of unintended disclosure to other local users, backups, or monitoring tools.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Context Fatigue → Consolidate & Split
1. Persist all critical facts, decisions, and TODO state to memory
2. Write a brief session summary to memory or a file
3. Suggest `/new` or session split for remaining work
4. If user wants to continue: prioritize ruthlessly, ignore tangent topics

• Confidence: 90% confidence
• Finding: Write a brief session summary to memory or a file 3. Suggest `/new` or session split for remaining work 4. If user wants to continue: prioritize ruthlessly, ignore tangent topics ### Attention Drift

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.