Swmm Modeling Memory

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:21 AM UTC
• Version: 0.7.3

Overview

This skill is a bounded modeling-memory summarizer that reads SWMM audit outputs and writes disclosed memory files, with some prompt-injection risk if untrusted run notes are later used as agent memory.

Install this only for SWMM projects where you want persistent modeling memory. Use trusted or reviewed run directories, keep --runs-dir and --out-dir narrowly scoped, disable per-run or audit-end memory refresh when mutation is unwanted, and review generated Markdown before using it in RAG or accepting any skill update proposal.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: scripts/summarize_memory.py:552

Finding

Persistent Agent Memory Poisoning Through Untrusted Audit Content

Content

View full analysis

dict[str, Any]: audit_dir = audit_dir_for(run_dir) provenance_path = audit_dir / "experiment_provenance.json" comparison_path = audit_dir / "comparison.json" note_path = audit_dir / "experiment_note.md" diagnostics_path = audit_dir / "model_diagnostics.json" provenance = read_json(provenance_path) comparison = read_json(comparison_path) model_diagnostics = read_json(diagnostics_path) note_text = read_text(note_path) audit_files_found = [name for name in AUDIT_FILES if (audit_dir / name).exists()] audit_files_missing = [name for name in AUDIT_FILES if name not in audit_files_found] artifacts_found, artifacts_missing = collect_artifact_ids(provenance) qa_status = infer_qa_status(provenance) metrics = provenance.get("metrics") if isinstance(provenance.get("metrics"), dict) else {} record = { "run_id": provenance.get("run_id") or run_dir.name, "run_dir": relpath(run_dir, runs_dir.parent), "case_name": provenance.get("case_name") or run_dir.name, "workflow_mode": provenance.get("workflow_mode") or "unknown", "objective": provenance.get("objective") or "", "audit_status": provenance.get("status") or ("partial" if audit_files_missing else "unknown"), "qa_status": qa_status, "swmm_return_code": metrics.get("swmm_return_code") if isinstance(metrics, dict) else None, "artifacts_found": artifacts_found, "artifacts_missing": sorted(set(artifacts_missing + audit_files_missing)), ...[truncated 5582 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md

- Do not modify any existing `SKILL.md` files.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill describes file read and file write behavior but does not declare an explicit tool scope such as permissions or allowed-tools. In an agent system, that omission can cause the runtime or reviewer to infer broader access than intended, increasing the risk of unauthorized reads of run artifacts or writes to arbitrary paths if downstream enforcement is weak or inconsistent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.