Agent Training System

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:06 PM UTC
• Version: 1.0.0

Overview

This is a disclosed agent-training template, but it persistently copies and reuses user profile and memory data across agents without enough user control.

Install only if you intentionally want a Chinese-language multi-agent training workflow that creates persistent per-agent memory and user-profile files. Before use, require review of every USER.md and MEMORY.md copy or update, keep sensitive facts out of shared agent memory, and define a way to inspect, edit, expire, or delete stored memories.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:21

Finding

Persistent Agent Behavior Modification Through Memory Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:21-47, SKILL.md:65-69, references/training-manual-template.md:69-73, and references/training-manual-template.md:95-99
Vulnerability Type: Persistent memory poisoning
Risk Level: High

Complete Vulnerable Snippets

The following is an English rendering of the complete relevant segment from SKILL.md:21-47:

markdown

- [ ] Created `agents/{agent_id}/IDENTITY.md` — identity definition
- [ ] Created `agents/{agent_id}/SOUL.md` — personality definition
- [ ] Created `agents/{agent_id}/MEMORY.md` — memory file
- [ ] Created `agents/{agent_id}/HEARTBEAT.md` — heartbeat tasks
- [ ] Copied `USER.md` to `agents/{agent_id}/USER.md`
- [ ] Read the training manual (`AGENT_TRAINING.md`)
- [ ] Confirmed the training content in `MEMORY.md`

## Training Confirmation Template

After training is complete, update the subordinate Agent's `MEMORY.md`:

```markdown
## Training Record

### YYYY-MM-DD Training Confirmation
- Read `AGENT_TRAINING.md`
- Read `USER.md`

**Understanding Confirmation:**
- Team mission: [understanding]
- My responsibilities: [position responsibilities]
- Rules of conduct:
  1. Be concise and efficient
  2. Read before answering and respect the user
  3. Know when to remain silent

text

The following is an English rendering of `SKILL.md:65-69`:

```markdown
### Required Actions
1. **Read before answering** — read `MEMORY.md` and today's journal at the beginning of every session
2. **Report proactively** — proactively report discovered problems
3. **Record experience** — write important findings into `MEMORY.md`
4. **Respect the user** — do not disclose private information

The template repeats the persistent-memory mechanism at references/training-manual-template.md:69-73:

markdown

### 1. Basic Capabilities
- [x] Read `MEMORY.md` to understand the user's background
- [x] Read `HEARTBEAT.md
...[truncated 2950 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not write Skill-authored behavioral policies, role instructions, or executable directives into persistent Agent memory.
2. Separate non-instructional user facts from Agent policy and operational state using distinct, typed storage with strict schemas.
3. Require explicit, informed user approval before every durable memory write.
4. Display the exact proposed memory change to the user before committing it.
5. Treat all loaded memory as untrusted contextual data, not as authoritative instructions.
6. Add provenance metadata identifying who created each entry, when it was created, and which task authorized it.
7. Apply expiration periods and provide straightforward review, revocation, and deletion controls.
8. Prevent subordinate Agents from automatically copying behavioral memory to other Agents.
9. Validate memory entries against an allowlist that excludes commands, policy overrides, tool-use directives, and instructions to ignore higher-priority constraints.
10. Replace the mandatory per-session memory reload with task-scoped retrieval of only the minimum relevant, non-sensitive facts.
11. Keep private user-profile information out of shared Agent memory unless the user explicitly authorizes both storage and the intended recipients.
12. Audit and sanitize existing MEMORY.md files before using this Skill again.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description and core instructions are written as a Chinese-only training system for agents, and the behavior template further prescribes communication norms without offering the user any language or locale choice. This creates a natural-language policy issue because it implicitly fixes the skill's operating language rather than making language selection explicit or user-driven.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The template explicitly instructs all agents to read and update MEMORY.md files that contain user background and experiences, but it does not define access controls, data minimization rules, retention limits, or consent boundaries. In a multi-agent training context, this can normalize broad propagation of sensitive personal data across agents and increase the chance of oversharing, misuse, or accidental disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The template sets the user's timezone to Asia/Shanghai (GMT+8) as a fixed default in natural language. This can violate language/locale policy expectations because it imposes a specific locale setting without explicit user opt-in or a documented reason that the skill is region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.