Session Watchdog

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:47 PM UTC
• Version: 1.0.0

Overview

This skill openly saves session checkpoints to local memory, but its automatic persistence is too broad and lacks privacy controls, so it should be reviewed before installation.

Install only if you are comfortable with the agent writing durable session summaries to local memory. Before using it, add or require controls to review each checkpoint, omit secrets and personal data, avoid storing raw external instructions, and limit when memory writes occur.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:29

Finding

Unsanitized Conversation Content Can Poison Persistent Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:29-49
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: Medium

Vulnerable Code

markdown

1. **Save checkpoint to memory file:**
   - Read current memory/YYYY-MM-DD.md
   - Add key context: decisions, pending tasks, important details
   - Write back to memory file

2. **Alert user:**
   Say: "⚠️ Approaching context limit (~160k tokens). Saving checkpoint to memory before continuing."

3. **Ask user:**
   - Continue and accept compaction?
   - Summarize and restart fresh?
   - Pause until ready?

## What to Save

Essential information that must survive compaction:

- **Decisions made** in this conversation
- **Pending tasks** not yet completed
- **Important context** (project state, configurations, preferences)

Technical Analysis

The checkpoint protocol instructs the agent to copy conversation-derived decisions, pending tasks, configurations, preferences, and other important details into a persistent daily memory file. It does not require content sanitization, provenance tracking, secret detection, an allowlist of safe fields, or explicit user approval before writing.

Because conversation content may be controlled by an untrusted user or obtained from untrusted material, malicious instructions can be represented as decisions, pending tasks, preferences, or important context. Once written to persistent memory, those instructions may be treated as trusted context by later sessions. This allows an indirect prompt-injection payload to survive context compaction and session boundaries.

The same mechanism can persist sensitive project details or plaintext configuration values. The Skill does not instruct the agent to exclude credentials, access tokens, private keys, personal information, or other secrets.

Attack Path

1. An attacker supplies a prompt or document containing a malicious directive, such as a purported pro ...[truncated 1527 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user confirmation immediately before creating or updating a persistent checkpoint.
2. Use a strict allowlist of factual fields that may be persisted, rather than broadly storing “important details,” configurations, or preferences.
3. Never persist credentials, tokens, private keys, authentication cookies, personal information, confidential configuration values, or raw untrusted document content.
4. Treat all conversation-derived content as untrusted data. Remove or neutralize imperative statements and prompt-like directives before persistence.
5. Record provenance for every saved item, including its source, timestamp, and whether the user explicitly approved it.
6. Clearly label checkpoint content as reference data that must not override system instructions, developer instructions, security policies, or current user intent.
7. Present the exact proposed checkpoint to the user for review and redaction before writing it.
8. Apply restrictive filesystem permissions and defined retention periods to memory files, and provide a reliable deletion mechanism.
9. On later reads, parse memory into a constrained data structure instead of inserting raw memory-file text into the agent's instruction context.
10. Add tests confirming that injected instructions and representative secret formats are rejected or redacted.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill is configured to run at the start of each new session and when users ask about session status or memory, which are broad conditions that can trigger outside genuine high-context situations. Because the skill performs persistence actions by reading and writing memory files, overbroad activation increases the chance of unnecessary storage of conversation details, including potentially sensitive project or user information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly directs the agent to read and write a dated memory file with decisions, pending tasks, project state, modified files, and unresolved issues, but it provides no minimization, consent, or sensitivity filtering requirements. This creates a real risk of persisting secrets, internal paths, personal data, or other confidential context beyond the immediate session, expanding exposure if the memory store is later accessed, reused, or leaked.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger section is ambiguous because it includes periodic and pre-task activation without clear scope limits, which can cause the skill to invoke during normal work rather than only when context exhaustion is likely. In this skill, ambiguous invocation is materially risky because invocation leads to checkpointing behavior that writes durable summaries of ongoing work to memory files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.