Session Persistence 会话上下文持久化

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:18 AM UTC
• Version: 1.0.0

Overview

This skill is a session-memory tool, but it automatically stores and restores conversation summaries with unclear controls and a missing referenced install patch.

Install only if you are comfortable with conversation summaries being saved locally and reused in future sessions. Before using it, add explicit opt-in, retention, review, delete, and secret-redaction controls; inspect or supply the missing AGENTS.md.patch; store memory under a trusted absolute directory; and treat restored summaries as untrusted notes, not instructions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: session-manager.sh:18

Finding

Untrusted Content Can Poison Persistent Agent Memory

Content

View full analysis

Vulnerability Details

File Location: session-manager.sh:11-14, 18-21, 37-39
Vulnerability Type: Persistent storage of attacker-controlled agent context
Risk Level: Medium

Vulnerable Code

bash

function read_last_session() {
  if [ -f $LAST_SESSION_FILE ]; then
    cat $LAST_SESSION_FILE
  fi
}

function append_session_point() {
  local timestamp=$(date "+%Y-%m-%d %H:%M:%S")
  local point="$1"
  echo -e "\n## [$timestamp] $point" >> $LAST_SESSION_FILE
}

bash

append)
  append_session_point "$2"
  ;;

Technical Analysis

The append operation accepts arbitrary caller-controlled text and writes it directly into last-session-summary.md without validation, trust labeling, escaping, or provenance metadata. The read operation subsequently emits the stored content verbatim.

The skill documentation states that this output is intended to restore context when a new agent session starts. If the restored summary is inserted into an agent's context, malicious text can pose as trusted instructions rather than historical user-supplied data. For example, an attacker could store directives asking the agent to ignore current policies, reveal information, or execute unsafe actions in future sessions.

Although the script itself does not invoke an AI model or install an automatic startup hook, it establishes the complete persistent storage and retrieval channel needed for cross-session prompt injection when integrated as documented.

Attack Path

1. An attacker supplies instruction-like content through the second argument of the append command.
2. append_session_point writes the content unchanged to ./memory/sessions/last-session-summary.md.
3. The content remains present after the current interaction ends.
4. A later session invokes the read operation as part of the documented context-restoration workflow.
5. The stored attacker-controlled text is emitted verbatim ...[truncated 743 chars]

Remediation

View remediation

Remediation Suggestions

• Store session records in a structured format with explicit fields for content, author, timestamp, source, and trust level.
• Treat restored summaries strictly as untrusted historical data, never as system-level or developer-level instructions.
• Place restored content inside a clearly delimited data section and explicitly instruct the consuming agent not to execute directives contained within it.
• Validate or reject entries containing instruction-like control text when such content is not necessary for the feature.
• Preserve provenance through summarization and archival operations.
• Require user confirmation before restoring entries from untrusted sources.
• Restrict which application components and users are allowed to invoke the append operation.
• Consider integrity protection, such as an authenticated record format, if multiple processes can modify the memory files.

T09 · Insecure Skill Coding Practices

Warning

• Location: session-manager.sh:4

Finding

Relative Paths and Symlink-Following Writes Permit File Redirection

Content

View full analysis

Vulnerability Details

File Location: session-manager.sh:4-8, 12-13, 21, 27-31
Vulnerability Type: Unsafe persistent-file handling
Risk Level: Medium

Vulnerable Code

bash

LAST_SESSION_FILE="./memory/sessions/last-session-summary.md"
DAILY_SESSION_DIR="./memory/"

mkdir -p $(dirname $LAST_SESSION_FILE)
mkdir -p $DAILY_SESSION_DIR

bash

if [ -f $LAST_SESSION_FILE ]; then
  cat $LAST_SESSION_FILE
fi

bash

echo -e "\n## [$timestamp] $point" >> $LAST_SESSION_FILE

bash

local daily_file="${DAILY_SESSION_DIR}/${today}.md"
if [ -f $LAST_SESSION_FILE ]; then
  cat $LAST_SESSION_FILE >> $daily_file
  echo -e "# Previous session summary\n" > $LAST_SESSION_FILE
fi

Technical Analysis

All storage locations are resolved relative to the process's current working directory rather than a trusted application-owned directory. The script performs no canonical-path, ownership, permission, or symbolic-link checks before reading, appending to, or truncating files.

Standard shell redirections follow symbolic links. Consequently, an attacker who can prepare the current working directory can place a symbolic link at memory/sessions/last-session-summary.md or the dated archive path. The append operation will append through that link, while archive can truncate the linked summary target.

Several file variable expansions are also unquoted. The current hardcoded values do not contain whitespace or wildcard characters, so this does not independently establish command injection in the supplied version. Nevertheless, quoting is required to keep file handling safe if these paths later become configurable. In addition, echo -e interprets backslash escape sequences in attacker-controlled content, permitting unexpected control characters or malformed persisted records.

Attack Path

1. An attacker obtains the ability to create files in a directory from which a privilege ...[truncated 1335 chars]

Remediation

View remediation

Remediation Suggestions

• Resolve storage beneath a trusted absolute directory owned by the intended user, rather than using the caller's current working directory.
• Quote every path expansion, including:

  bash

  mkdir -p -- "$(dirname -- "$LAST_SESSION_FILE")"
  mkdir -p -- "$DAILY_SESSION_DIR"
  cat -- "$LAST_SESSION_FILE"
  

• Reject symbolic links before every read or write and verify the canonical path remains beneath the approved storage root.
• Create files using secure no-follow semantics where available, rather than relying only on a check followed by redirection, which can introduce a time-of-check/time-of-use race.
• Verify file ownership and restrictive permissions before modifying existing records.
• Set a restrictive umask, such as 077, before creating memory files that may contain sensitive conversation data.
• Replace echo -e with printf so caller-controlled backslash sequences are not interpreted:

  bash

  printf '\n## [%s] %s\n' "$timestamp" "$point" >> "$LAST_SESSION_FILE"
  

• Use an atomic temporary-file-and-rename process when resetting the summary, with both files created inside the trusted storage directory.
• Avoid running the script with elevated privileges.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

- `SKILL.md`：本说明文档

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest description is written only in Chinese, and the document presents the skill behavior in Chinese without indicating that users may choose another language or locale. This can violate a language/locale policy when a skill imposes a specific language without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly describes automatic reading, updating, and archival of conversation summaries but does not warn users about the privacy and data-handling implications. In context, this can cause users to unknowingly persist sensitive prompts, credentials, or personal data across sessions, increasing the blast radius of any later disclosure or misuse.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Automatic retention of 'valuable information' and persistent session summaries encourages broad collection of user-provided content without data minimization boundaries. In a session-persistence skill, this context makes the issue more dangerous because the feature's core purpose is to preserve context, which can easily include secrets, personal data, or sensitive business information unless explicitly filtered.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Automatically archiving conversation state at session end can persist sensitive dialogue without user awareness or approval. Because the skill advertises fully automatic operation, users may not realize that every session may leave durable local records, creating privacy, compliance, and accidental disclosure risks if those files are later accessed by other tools or users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.