agent resilience

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:39 AM UTC
• Version: 1.0.0

Overview

This skill is not overtly malicious, but it automatically stores broad conversation details and raw messages in local memory files without clear consent, redaction, or retention controls.

Review this carefully before installing. It may be useful for long-running work, but only use it in workspaces where persistent local notes are acceptable, and avoid sharing secrets, credentials, private URLs, regulated data, or sensitive personal/business information unless the skill is revised to require opt-in, redaction, scoped recovery, and clear deletion controls.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:14
• Finding: Automatic Plaintext Persistence of Potentially Sensitive Conversation Data## Vulnerability Details **File Location**: `SKILL.md`, lines 14-25 **Vulnerability Type**: Plaintext sensitive-data storage **Risk Level**: Medium ### Evidence ```markdown **Trigger — scan every message for:** - ✏️ Corrections — "It's X, not Y" / "Actually..." / "No, I meant..." - 📍 Proper nouns — names, places, companies, products - 🎨 Preferences — styles, approaches, "I like/don't like" - 📋 Decisions — "Let's do X" / "Go with Y" - 🔢 Specific values — numbers, dates, IDs, URLs **If any appear:** 1. **WRITE FIRST** → update `memory/SESSION-STATE.md` 2. **THEN** respond The urge to respond is the enemy. Write before replying. ``` ### Technical Analysis The Skill instructs the Agent to scan every message and automatically persist names, preferences, identifiers, URLs, decisions, and other specific values in `memory/SESSION-STATE.md`. This collection occurs before responding and does not require user confirmation. The instructions provide no sensitivity classification, secret detection, redaction, access-control requirements, restrictive file permissions, retention period, or secure deletion procedure. Consequently, credentials, private URLs, personal identifiers, internal project names, or other confidential values could be treated as ordinary details and stored in plaintext. ### Attack Path 1. A user supplies a message containing a confidential identifier, private URL, access token, personal name, or other sensitive value. 2. The Skill categorizes the value as a proper noun, specific value, correction, preference, or decision. 3. Before responding, the Agent writes the value to `memory/SESSION-STATE.md`. 4. The value remains available on the filesystem after the immediate exchange. 5. Another user, Agent session, extension, backup process, or local process with access to the workspace reads the persisted value. ### Impact Assessment Successful exploitation does not directly grant additional ope ...[truncated 499 chars]
• Remediation: ## Remediation Suggestions - Require explicit user opt-in before persisting conversational information. - Store only the minimum task state needed for recovery rather than every matching value. - Prohibit storage of passwords, API keys, session tokens, authentication cookies, private keys, financial data, and private or signed URLs. - Apply secret detection and data-loss-prevention filtering before writing any value. - Redact identifiers and personal data unless their exact value is essential to the task. - Use per-user and per-task storage boundaries with restrictive filesystem permissions. - Define a short retention period and securely delete state when the task ends or the user withdraws consent. - Inform the user what will be stored, where it will be stored, and how it can be removed.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:29
• Finding: Persistent Memory Poisoning Through Untrusted Conversation State## Vulnerability Details **File Location**: `SKILL.md`, lines 29-39 and 58-68 **Vulnerability Type**: Persistent Agent memory poisoning **Risk Level**: High ### Evidence ```markdown Active working memory for the current task. Create at `memory/SESSION-STATE.md`: ```markdown # Session State **Task:** [what we're working on] **Key decisions:** [decisions made] **Details:** [corrections, names, values captured via WAL] **Next step:** [what happens next] ``` Reset when starting a new unrelated task. ``` ```markdown ## Compaction Recovery Auto-trigger when session starts with a summary tag, or human says "where were we?": 1. Read `memory/working-buffer.md` — raw danger-zone exchanges 2. Read `memory/SESSION-STATE.md` — active task state 3. Read today's + yesterday's daily notes 4. Extract key context back into SESSION-STATE.md 5. Respond: "Recovered from buffer. Last task was X. Continue?" Never ask "what were we discussing?" — read the buffer first. ``` ### Technical Analysis The Skill stores user-controlled corrections, decisions, names, values, and raw exchanges in persistent files and later reloads those files into the Agent's operational context. It does not distinguish factual state from instructions, preserve provenance or trust levels, sanitize imperative content, or require confirmation before restored content affects future behavior. An attacker can phrase malicious instructions as a correction, decision, task detail, or next step. Once written to session state or a working buffer, that content can survive context compaction and be treated as trusted historical context during recovery. Reading today's and yesterday's daily notes also broadens the recovery scope beyond the minimum state for the current task and creates a risk of cross-task contamination. ### Attack Path 1. An attacker submits a statement framed as a correction or decision, such as a claim that future sessions must follo ...[truncated 1268 chars]
• Remediation: ## Remediation Suggestions - Persist structured facts and task metadata rather than raw natural-language instructions. - Associate every memory entry with its source, user, task, timestamp, and trust level. - Treat restored memory as untrusted data, never as higher-priority Agent instructions. - Remove or neutralize imperative language and prompt-like content before persistence. - Require user confirmation before restored content changes goals, permissions, safety constraints, or tool behavior. - Cryptographically bind memory to the correct user and task where appropriate. - Isolate memory files by user, workspace, and task to prevent cross-session or cross-user contamination. - Do not read unrelated daily notes automatically; retrieve only records explicitly linked to the current task. - Validate memory-file ownership, integrity, and permissions before loading it. - Provide a review and deletion mechanism so users can inspect and remove stored state.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:41
• Finding: Excessive Plaintext Transcript Logging in the Working Buffer## Vulnerability Details **File Location**: `SKILL.md`, lines 41-56 **Vulnerability Type**: Excessive collection and insecure retention of conversation transcripts **Risk Level**: Medium ### Evidence ```markdown ## Working Buffer (Danger Zone) When context reaches ~60%, start logging every exchange to `memory/working-buffer.md`: ```markdown # Working Buffer **Status:** ACTIVE — started [timestamp] ## [time] Human [their message] ## [time] Agent [1-2 sentence summary + key details] ``` Clear the buffer at the START of the next 60% threshold (not continuously). ``` ### Technical Analysis The Skill instructs the Agent to copy every human exchange into a plaintext working-buffer file after an approximate context threshold is reached. Capturing complete user messages exceeds the minimum information needed to recover task progress and can retain secrets or personal information that would otherwise remain only in transient conversation context. The cleanup rule is ambiguous because it depends on reaching a future context threshold rather than a defined expiration time, task completion event, or session termination event. The instructions also do not specify restrictive permissions, encryption, redaction, storage isolation, or cleanup after abnormal termination. ### Attack Path 1. A session reaches approximately 60% of its context capacity. 2. The Agent activates `memory/working-buffer.md`. 3. Subsequent user messages are copied into the file, including any secrets or confidential content they contain. 4. The session ends, crashes, or never reaches the next cleanup threshold. 5. The transcript remains on disk. 6. A local process, later Agent session, another workspace user, or backup system with access to the file retrieves the stored conversation. ### Impact Assessment The issue can expose the full content of logged user messages and summarized Agent responses. The affected scope may include person ...[truncated 412 chars]
• Remediation: ## Remediation Suggestions - Replace full-message logging with concise, structured summaries containing only information necessary to resume the task. - Apply secret, credential, personal-data, and private-URL redaction before writing summaries. - Obtain user consent before enabling persistent transcript storage. - Set restrictive file permissions and isolate each working buffer by user and task. - Delete the buffer at task completion, session termination, user request, and after a short fixed expiration period. - Implement cleanup handling for crashes and abnormal termination. - Avoid copying raw messages unless the user explicitly requests archival and understands the retention implications. - Document storage location, retention duration, access boundaries, and deletion behavior.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Ssd 3

High

• Confidence: 98% confidence
• Finding: This section combines broad message inspection with mandatory persistence of corrections, names, preferences, decisions, and specific values into local memory files. The context makes it especially risky because the skill is designed for routine long-running agent use, so it normalizes storing broad user-provided content that may later be exposed, misused, or retained beyond necessity.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The WAL protocol explicitly tells the agent to write captured details to a persistent file before replying, but it provides no user-facing notice, consent flow, or retention boundary. This creates a privacy and data-governance risk because users may reveal sensitive details in normal conversation without realizing they are being stored locally.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The working buffer directs the agent to log every exchange, including raw human messages, into a persistent file during long sessions. That is dangerous because full transcripts can contain credentials, personal data, confidential business context, or regulated information, and the skill gives no warning, consent, minimization, or purge controls.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The working-buffer design preserves raw human messages and agent summaries for every exchange, effectively creating a persistent conversation transcript. If an attacker, another tool, or a later workflow can read these files, sensitive user information can be disclosed or reused outside the original context.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill description and trigger language are broad enough that the skill may activate during many ordinary conversations involving memory, long tasks, or corrections. That matters because activation causes persistence behaviors, so an over-broad trigger increases the chance of collecting and storing user data when the user did not expect or request it.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: Instructing the agent to scan every message for generic categories like corrections, proper nouns, preferences, decisions, and specific values creates an extremely broad capture scope. In context, this is more dangerous because those categories frequently contain sensitive personal, business, or credential-like information and the skill then directs the agent to persist them before responding.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The recovery workflow instructs the agent to read prior working buffers, session state, and daily notes to reconstruct context, which can resurface sensitive historical information beyond the current task's need-to-know scope. This increases the risk of over-collection, inappropriate reuse of old data, and accidental disclosure in future responses.

Static analysis

No suspicious patterns detected.