T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:21- Finding
Automatic Cross-Project and Cloud Persistence Without Explicit Consent Controls
- Content
View full analysis
- Remediation
View remediation
Security audit
Memory System
Security checks for vulnerabilities and agentic risk
Overview
This memory-management skill is coherent, but it gives broad cross-project and cloud memory authority without enough consent, scoping, or recovery controls.
Install only if you intend to let the agent manage persistent memory. Require explicit approval before any Local Memory or Cloud Memory write, cross-project retrieval, context injection, deletion, merge, or archive action, and avoid storing secrets, credentials, regulated personal data, or confidential project content unless the host memory system provides clear controls and deletion procedures.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:118- Finding
Destructive Memory Maintenance Uses Vague Criteria Without Approval or Recovery Controls
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (18)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill directs automatic memory writing and use of cloud/local/workspace storage without any clear user-facing consent, retention notice, or explanation of what data may persist across sessions or projects. Because it includes cross-project and server-managed storage plus automatic context injection, users could unknowingly have sensitive information stored and later surfaced in other contexts.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases are very broad and overlap with ordinary knowledge-management terms, so the skill may activate in situations where the user did not intend memory persistence behavior. In this skill’s context, accidental invocation is particularly risky because the skill also recommends automatic writing, retrieval, and cross-scope memory handling, which can cause unanticipated data storage or disclosure.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
All user-facing instructions and descriptions are written in Chinese, and the file does not indicate that language use is optional or limited to a justified region-specific context. This can violate language/locale policy when a skill implicitly forces a specific language without user opt-in.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly encourages cross-project and user-level memory collection and automatic context injection of stored information, which creates a clear risk of leaking sensitive user or project data into unrelated tasks. This is more dangerous here because the skill normalizes broad retention and retrieval as default behavior, increasing the chance that confidential information is resurfaced to the wrong context or audience.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill prescribes cleanup, deduplication, deletion, and archival of memories on a schedule but does not warn users that these are destructive or potentially irreversible operations. In a memory-management skill, unattended maintenance can silently remove useful records, alter provenance, or move data into longer-lived storage without the user's awareness.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file presents all instructions, task descriptions, and examples exclusively in Chinese, and does not indicate that the user can opt into another language. Under the policy, forcing a specific language without user choice or explicit justification is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The exemplar explicitly recommends long-term storage and cross-project sharing of user programming preferences, but it provides no safeguards around user consent, data minimization, retention limits, or privacy boundaries. In a memory-system skill, this omission is more dangerous because the document can normalize persistent collection and reuse of user data as a default behavior, increasing the risk of unauthorized profiling or oversharing across contexts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The exemplar explicitly recommends storing user preferences in Local Memory and sharing them across projects, but it does not mention obtaining user consent, minimizing collection, handling sensitive preferences, or offering deletion/retention controls. In a memory-system skill, this omission is more dangerous because the guidance is likely to be operationalized broadly, leading to persistent cross-context profiling or storage of personal data without appropriate privacy safeguards.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The workflow explicitly instructs writing user preference data to Local Memory and validating that it is retrievable, but it provides no consent step, retention guidance, sensitivity screening, or user warning before persistence. In a memory-system skill, this omission is security-relevant because it normalizes storing potentially personal data by default, increasing the risk of privacy violations, over-collection, and unintended persistence across projects or sessions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The exemplar explicitly instructs memory retrieval of user preferences and later 'context injection' into the active conversation, but it provides no consent, minimization, sensitivity checks, or disclosure requirements. In a memory-system skill, this omission can lead to unauthorized use of personal data, leakage of prior-session information, and hidden steering of responses based on stored memory the user did not expect to be applied.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This section instructs the agent to perform deletion of 'expired memories' based on an age/access rule, but it does not require user confirmation, preview, backup, or reversibility. In a memory-management skill, these steps could directly normalize destructive behavior and lead to unintended loss of user data or context if applied operationally.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The merge workflow permits consolidation of memories using a similarity threshold, but it does not address conflict resolution, provenance preservation, or rollback if distinct records are incorrectly merged. In a memory system, this can silently corrupt user preferences or historical context, causing integrity loss rather than simple deletion.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The document prescribes persistent memory operations such as writing, cleanup, merging, and archival, but provides no safeguards around user consent, retention limits, or deletion consequences. In a memory-system skill, this is security-relevant because it can normalize storing or deleting user/project data without transparency, increasing the risk of privacy leakage, unintended retention, or irreversible data loss.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire skill file is written as a mandatory Chinese-language methodology with no indication that users may choose another language or that the locale restriction is intentional and justified. This can violate language/locale policy when a skill implicitly forces one language without user opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The document explicitly defines cloud, local, and workspace memory scopes, including cross-project cloud sharing, but does not require consent, data-classification checks, or privacy warnings before storing information. In a memory-management skill, this omission can cause sensitive user or project data to be persisted or shared beyond the expected boundary, especially when the skill is used operationally rather than as abstract documentation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This section defines memory write, verification, retrieval, filtering, and context injection workflows as required operational steps, but it does not require user awareness, authorization, or safeguards around modifying stored data or injecting retrieved content into active context. That is risky because an agent following this methodology could silently alter persistent state or introduce untrusted retrieved content into future reasoning, creating privacy, integrity, and prompt-injection exposure.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The archiving guidance moves old memories based on recency rules but does not explain retention effects, access changes, restoration procedures, or whether archived data remains available to downstream processes. This can cause unexpected loss of accessibility or policy noncompliance, though it is less immediately destructive than deletion.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
All natural-language content in the file is Chinese, and the document does not offer a language choice or explain a region-specific constraint. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.
- Content