Agent Experience Graph

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:50 AM UTC
• Version: 0.1.1

Overview

This skill is a disclosed local helper for reusing agent trace summaries, with ordinary caution needed around what traces you store or trust.

Install only if you want a local trace-recommendation helper. Keep trace libraries sanitized, avoid secrets or private raw work logs, and do not let an agent automatically follow recommended tools, skills, or lessons from untrusted traces without review.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: scripts/recommend_traces.py:206

Finding

Persistent Trace Poisoning Can Manipulate Future Agent Recommendations

Content

View full analysis

Vulnerability Details

File Location: scripts/recommend_traces.py:153-169, scripts/recommend_traces.py:187-202, and scripts/recommend_traces.py:206-216
Vulnerability Type: Persistent agent memory poisoning through insufficient validation of trace content
Risk Level: Medium

The trace append function accepts attacker-controlled records after validating only that id, task, and outcome are present. Arbitrary values in skills, tools, lessons, and nested subtasks are persisted to the trace library. During later queries, these values are returned verbatim as recommendations and may influence an integrating agent.

Vulnerable Code

scripts/recommend_traces.py:206-216:

python

def append_trace(traces_path, new_trace_arg):
    traces = load_traces(traces_path)
    new_trace = load_json_arg(new_trace_arg)
    if not isinstance(new_trace, dict):
        raise ValueError("New trace must be a JSON object.")
    if not new_trace.get("id") or not new_trace.get("task") or not new_trace.get("outcome"):
        raise ValueError("New trace requires id, task, and outcome.")
    traces = [trace for trace in traces if trace.get("id") != new_trace["id"]]
    traces.append(new_trace)
    save_traces(traces_path, traces)
    return {"appended": new_trace["id"], "trace_count": len(traces)}

scripts/recommend_traces.py:153-169:

python

        evidence_id = trace.get("id", "unknown")
        for _, trace_subtask, pair_score in matched_pairs:
            if pair_score <= 0:
                continue
            for skill in trace_subtask.get("skills", []):
                skill_evidence[skill].append((score * pair_score, evidence_id))
            for tool in trace_subtask.get("tools", []):
                tool_evidence[tool].append((score * pair_score, evidence_id))
            for lesson in trace_subtask.get("lessons", []):
                lesson_evidence.append((score * pair_
...[truncated 4087 chars]

Remediation

View remediation

Remediation Suggestions

1. Enforce a strict trace schema before persistence

   • Require exact field types.
   • Restrict outcome to success, partial, or failure.
   • Require strings in all skill, tool, lesson, and constraint arrays.
   • Validate nested subtask objects recursively.
   • Reject unknown fields when they are not needed.

2. Constrain attacker-controlled content

   • Apply reasonable maximum lengths and collection-size limits.
   • Reject control characters and malformed identifiers.
   • Treat free-form lessons as untrusted data rather than executable instructions.
   • Consider limiting skills and tools to an administrator-approved registry.

3. Add provenance and trust metadata

   • Record the trace source, author, import time, and verification status.
   • Keep trusted and untrusted trace libraries separate.
   • Prefer signed trace sets for shared or centrally distributed datasets.
   • Prevent untrusted traces from replacing trusted records merely by reusing an identifier.

4. Make trust boundaries explicit in output

   • Mark every recommendation as untrusted historical content.
   • Return provenance and trust level alongside each lesson, skill, and tool.
   • Delimit trace text so consuming language models do not confuse it with system or developer instructions.

5. Require confirmation before consequential use

   • Do not automatically install, invoke, or grant permissions to a recommended tool or skill.
   • Require human approval or policy validation before acting on trace-derived guidance.
   • Ensure consuming agents independently verify that recommendations fit current security constraints.

6. Use safer file update controls

   • Restrict write permissions on trusted trace libraries.
   • Use atomic writes and appropriate file permissions.
   • Audit append and replacement operations so poisoned records can be identified and removed.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description suggests a memory, recommendation, or experience-reuse capability involving prior traces and task comparison. The actual code does not implement any of those behaviors. It only loads capability.json from disk and prints it. That is a materially different primary purpose, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 79% confidence

Finding

The skill instructs the agent to read and append local trace files via Python scripts, but it does not declare any explicit tool scope or permissions boundary. In agent environments that rely on metadata to constrain filesystem access, this can lead to broader-than-expected file read/write behavior and increases the risk of accidental access to sensitive local data or modification of unintended files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script writes to the path supplied by --traces and creates parent directories if needed, which modifies the user's filesystem. While this behavior is part of the append feature, there is no confirmation prompt, log message explaining the write target, or inline warning/comment disclosing that the trace file will be created or overwritten.

Content

No source excerpt is available for this finding.