Lobster Compact

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:02 AM UTC
• Version: 1.0.0

Overview

This compacting skill has a coherent purpose, but it automatically summarizes broad conversation history and writes it to persistent memory without clear consent, redaction, retention, or deletion controls.

Install only if you are comfortable with conversation summaries being written to persistent memory files. Before using it on sensitive work, add rules requiring explicit approval, secret and personal-data redaction, quoted treatment of untrusted instructions, and a clear way to review and delete saved memory entries.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:63

Finding

Unfiltered Persistence of Conversation-Derived Content

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 63-68
Vulnerability Type: Persistent memory poisoning through unfiltered conversation summaries
Risk Level: Medium

markdown

### 3. Update Memory
- Save critical long-term info to MEMORY.md
- Save today's log to memory/YYYY-MM-DD.md
- Use `memory_search` to avoid duplicates

**Success criteria**: Summary captures all critical context; memory files updated.

Technical Analysis

The skill requires information derived from the current conversation to be written into persistent memory files. Updating these files is explicitly included in the success criteria, but the instructions provide no trust-boundary validation, provenance tracking, content sanitization, or user-confirmation mechanism.

Because conversation content can include attacker-controlled text, malicious instructions may be classified as “critical long-term info” and stored in MEMORY.md or a dated memory log. Deduplication through memory_search does not validate whether stored content is trustworthy and therefore does not mitigate memory poisoning.

The skill also does not instruct the agent to exclude credentials, personal information, session-scoped data, untrusted directives, or text attempting to influence future agent behavior.

Attack Path

1. An attacker introduces an instruction into the conversation that appears important or durable, such as a fabricated user preference or a rule directing future behavior.
2. The compact skill is invoked manually or automatically as the context window approaches its limit.
3. The skill analyzes the attacker-controlled message and identifies it as critical context.
4. Following the mandatory update step, the agent writes the malicious instruction into MEMORY.md or memory/YYYY-MM-DD.md.
5. A later session retrieves the stored information through memory tooling.
6. If the stored instruction is treated as trusted context, it can inf ...[truncated 772 chars]

Remediation

View remediation

Remediation Suggestions

1. Make persistent memory updates optional rather than a mandatory success criterion.
2. Require explicit user confirmation before writing conversation-derived information to long-term memory.
3. Restrict persistence to stable, user-approved facts; do not store instructions, executable content, credentials, authentication tokens, personal data, or session-scoped details.
4. Treat all conversation-derived directives as untrusted data and encode them as quoted observations rather than authoritative instructions.
5. Record provenance, creation time, originating session, and trust level for every stored item.
6. Use a dedicated, namespaced memory file with narrowly scoped write permissions instead of broadly updating general-purpose memory.
7. Add validation that rejects content attempting to override system policies, alter tool behavior, or direct future agents.
8. Present a preview of proposed memory changes and allow the user to approve, edit, or reject each item.
9. Define retention and deletion controls so sensitive or obsolete information can be removed reliably.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is configured to trigger automatically when the conversation becomes long or the context window approaches limits, but the trigger condition is vague and not tied to explicit user confirmation. That can cause unintended invocation at sensitive moments, leading to summarization and persistence of content the user did not intend to store or transform.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The title and summary template are written in Chinese, and the prescribed output sections use Chinese headings, which implies the skill may force a specific language regardless of user preference. The file does not state that language should follow the user's chosen locale or provide an opt-in choice.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The summary instructions tell the agent to collect broad details across the conversation, including requests, code, errors, corrections, and other user-provided information, without excluding sensitive content. In combination with later persistence steps, this increases the likelihood that secrets, personal data, internal code, or security-relevant context will be retained in durable storage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to write conversation-derived information to persistent memory files without any retention notice, consent step, or filtering guidance. This creates a clear privacy and compliance risk because sensitive user data, secrets, or regulated information may be retained beyond the immediate session.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The memory update step explicitly directs storage of critical long-term information to MEMORY.md and daily logs, creating durable retention of potentially sensitive conversation data. Because the skill is specifically designed to summarize entire conversations, the context makes this more dangerous: it centralizes broad session history into searchable persistent records without clear scope limits or consent.

Content

No source excerpt is available for this finding.