龙虾知识体系管理

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:31 AM UTC
• Version: 1.0.0

Overview

This skill is a workspace memory system, but it needs review because it can persist task details and turn repeated conversation feedback into future agent rules without clear approval or redaction controls.

Review this skill before installing. It may be useful if you intentionally want a persistent Markdown memory system, but use it only in workspaces where persistent logs and agent-rule updates are acceptable. Require manual approval before changes to AGENTS.md, SOUL.md, TOOLS.md, MEMORY.md, or HEARTBEAT.md, and add redaction and retention rules for secrets, personal data, customer data, and sensitive project context.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:328

Finding

Unvalidated Promotion of Conversation-Derived Instructions into Persistent Agent Rules

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 328-349
Vulnerability Type: Persistent agent memory poisoning
Risk Level: Medium

Relevant source segment translated into English:

markdown

Common category values:
- `correction` — User correction
- `best_practice` — A better approach was discovered
- `knowledge_gap` — Knowledge is outdated or missing

### Promotion Rules (Important)

When the same type of issue occurs three or more times, refine it into a permanent rule:

| Entry type | Promote to |
|------------|------------|
| Workflow | AGENTS.md |
| Behavioral principle | SOUL.md |
| Tool technique | TOOLS.md |
| Fact/decision | MEMORY.md |

After promotion, update the status from `pending` to `promoted`.

Technical Analysis

The Skill directs the Agent to classify user corrections as learning entries and automatically promote repeated entries into persistent control files such as AGENTS.md and SOUL.md. These files govern future workflows and behavioral principles.

Repetition is the only documented promotion criterion. The process does not require provenance verification, a trust assessment, a safety-policy review, or explicit user approval. Consequently, attacker-controlled conversational instructions can cross the boundary between untrusted session input and persistent Agent policy.

This is a memory-poisoning condition rather than immediate code execution. Exploitation depends on an Agent adopting the documented workflow and having write access to the workspace.

Attack Path

1. An attacker submits a malicious or misleading instruction and presents it as a correction to the Agent's behavior.
2. Following the Skill, the Agent records the correction in .learnings/LEARNINGS.md.
3. The attacker repeats the same class of correction at least three times across one or more interactions.
4. The Agent treats the repetition threshold as satisfied and promotes the i ...[truncated 868 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit, informed user approval before promoting any conversation-derived entry into a persistent control file.
2. Treat corrections, retrieved content, tool output, and sub-Agent messages as untrusted data rather than authoritative policy.
3. Add a mandatory safety review that rejects rules attempting to change security constraints, permission boundaries, credential handling, or tool authorization.
4. Preserve provenance for every learning entry, including source session, author, timestamp, exact original text, and approval status.
5. Replace repetition-based automatic promotion with a review queue. Repetition may increase review priority but must not establish trust.
6. Restrict writes to SOUL.md, AGENTS.md, and TOOLS.md through allowlisted update operations or human-reviewed changes.
7. Maintain version history and provide an automatic rollback mechanism for promoted rules.
8. Separate descriptive memory from executable instructions so facts stored in memory cannot silently become behavioral directives.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:235

Finding

Insufficient Redaction and Retention Controls for Persistent Activity Logs

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 235-240 and 286-319
Vulnerability Type: Plaintext retention of potentially sensitive task and error context
Risk Level: Medium

Relevant source segments translated into English:

markdown

STOP → SEARCH → RECORD → PLAN → ACT → Report → Record

- **STOP**: Do not reply immediately; first analyze task complexity.
- **SEARCH**: Search related workspace files for context.
- **RECORD**: Immediately write to the `In Progress` section of
  `memory/today.md`.
- **PLAN**: If the task requires more than three tool calls or more than
  five minutes, write `temp/task-name-plan.md`.
- **ACT**: Proceed after sufficient confidence.

markdown

### Error
Original error message

### Context
- Operation: ...
- Environment: ...

### Details
Full context

Technical Analysis

The workflow instructs the Agent to persist every task immediately in a daily Markdown log. Its error and learning templates additionally request original error messages, environment information, and full context.

Although the document prohibits credentials in MEMORY.md, it does not apply an equivalent prohibition or redaction policy to memory/YYYY-MM-DD.md, .learnings/ERRORS.md, .learnings/LEARNINGS.md, or temporary plan files. Original errors and full contextual data commonly contain access tokens, API parameters, local paths, usernames, customer data, internal hostnames, or confidential conversation content.

Because these files are persistent plaintext Markdown, sensitive information copied into them can outlive the originating session and become available to future Agents or any process with workspace read access.

Attack Path

1. A task, tool result, or error contains a secret or sensitive value, such as an API token, private path, personal record, or internal service address.
2. The Agent follows the documented workflow and records the task in th ...[truncated 1066 chars]

Remediation

View remediation

Remediation Suggestions

1. Make persistent task logging opt-in for sensitive workflows rather than automatic.
2. Apply one redaction policy to every persistent or temporary file, including daily memory, learning logs, error logs, plans, and sub-Agent memory.
3. Detect and remove common secret formats before writing, including API keys, bearer tokens, passwords, cookies, private keys, connection strings, and authorization headers.
4. Store summaries instead of original errors or full conversation context. Retain only the minimum data needed for future operation.
5. Require user confirmation before retaining personal, confidential, or regulated information.
6. Define retention periods and periodically delete expired daily logs, errors, learning records, and temporary plans.
7. Apply restrictive filesystem permissions so only the intended Agent identity can read or modify memory files.
8. Separate each Agent's memory by access boundary and prevent the main Agent from reading sub-Agent records unless the current task requires it.
9. Encrypt sensitive retained data at rest where persistence is unavoidable, with keys stored outside the workspace.
10. Add automated tests that seed representative secrets into task and error content and verify that no unredacted value reaches persistent files.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file consistently specifies the skill in Chinese, including the manifest description and all operating instructions, but it does not state that Chinese is optional or that the skill is intended only for a Chinese-speaking context. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.