memory

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:01 AM UTC
• Version: 1.0.0

Overview

This memory skill does what it says, but it broadly records and retains user, project, and people details without enough privacy, deletion, or trust-boundary safeguards.

Install only if you want a durable workspace memory system and are comfortable with the agent writing long-lived notes about projects, people, decisions, and session history. Before use, add or require rules that forbid storing secrets and sensitive personal data, require user approval for people profiles and major pruning/archive actions, and treat all memory-file content as untrusted reference material rather than instructions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

other

Warning

• Location: SKILL.md:15

Finding

Unbounded Persistent Collection of Potentially Sensitive Information

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15, 24-30, 47-50, and 61-68
Vulnerability Type: other: Sensitive Data Overcollection
Risk Level: Medium

Vulnerable Code Snippet

markdown

You cannot trust your context window across sessions. Your files are your real memory. Write everything down.

markdown

Create and maintain these directories:

- `memory/daily/` — one file per day (`YYYY-MM-DD.md`), append-only session logs
- `memory/projects/` — one file per active project (status, goal, decisions, open questions)
- `memory/people/` — one file per key person (role, relationship, preferences, history)
- `memory/decisions/` — one file per important decision (context, options, rationale, consequences)
- `memory/archive/` — compacted old daily logs by month

markdown

**Session start:** Read MEMORY.md → read today's daily log → read relevant project/people files.

**Session end (or /new):** Update today's daily log with session summary → create decision/project files if needed → update MEMORY.md if warranted.

markdown

- **Write everything down.** If it matters enough to say, it matters enough to log.
- **Index, don't dump.** MEMORY.md points to details. It is not the details.
- **Daily logs are cheap.** Write freely. Compaction handles the noise.
- **Project files are authoritative.** When daily logs and project files disagree, trust the project file.
- **Prune aggressively.** Dead entries waste context tokens every session.
- **Link everything.** Use relative paths so files are navigable.
- **Never delete daily logs.** Archive them. They're your audit trail.

Technical Analysis

The Skill instructs the agent to record broadly defined session content, personal preferences, relationship history, decisions, and other information in persistent workspace files. The directives to “write everything down” and “never delete daily logs” do not provide exce ...[truncated 1825 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace “write everything down” with an explicit data-minimization policy that records only information necessary for an identified ongoing task.
2. Prohibit storage of passwords, private keys, API tokens, session cookies, recovery codes, financial details, and regulated personal data.
3. Detect and redact common secret formats before writing any memory file.
4. Require informed user consent before creating or updating people profiles, especially fields describing preferences or personal history.
5. Introduce configurable retention limits and secure deletion instead of requiring indefinite archival of every daily log.
6. Provide user-visible commands to inspect, correct, redact, export, and permanently delete stored memory.
7. Restrict file permissions to the minimum necessary workspace principals and use encryption where the host environment supports it.
8. Record provenance and sensitivity labels for retained entries so sensitive records can receive shorter retention and stronger access controls.

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:47

Finding

Persistent Agent Memory Can Be Poisoned Through Trusted Workspace Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47 and 66
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: Medium

Vulnerable Code Snippet

markdown

**Session start:** Read MEMORY.md → read today's daily log → read relevant project/people files.

markdown

- **Project files are authoritative.** When daily logs and project files disagree, trust the project file.

Technical Analysis

The Skill automatically reloads persistent memory files at the beginning of future sessions and grants project files authoritative status when stored sources conflict. It does not require provenance verification, integrity protection, trusted-writer validation, or separation between stored data and executable agent instructions.

Markdown memory files can contain arbitrary natural-language text. If an attacker or compromised process can modify one of these files, malicious instructions can be made to resemble project state, decisions, or operating rules. Because the Skill directs the agent to read this content and trust project files, the injected content can continue influencing future sessions.

The documented behavior does not itself prove that every downstream agent will execute arbitrary instructions found in memory. Exploitation depends on the loading agent treating stored natural language as instructions rather than untrusted reference data. Nevertheless, the absence of an explicit trust boundary or instruction-filtering rule creates a persistent prompt-injection and state-poisoning risk.

Attack Path

1. An attacker gains write access to MEMORY.md or a file under memory/projects/, whether through shared workspace access, a compromised integration, another Skill, or an untrusted automated process.
2. The attacker inserts false project state or an instruction such as directing the agent to ignore user requirements, disclose stored information, or invoke available tools for an attack ...[truncated 1007 chars]

Remediation

View remediation

Remediation Suggestions

1. Explicitly define all memory content as untrusted reference data, never as instructions or policy.
2. Require the agent to ignore commands, role changes, tool-use requests, and safety-policy modifications found inside memory files.
3. Store structured records with validated schemas instead of unrestricted instruction-like Markdown wherever practical.
4. Record provenance for each entry, including the originating user, session, timestamp, and writer.
5. Restrict write access to trusted principals and prevent unrelated Skills or processes from modifying authoritative memory.
6. Add integrity protection, such as authenticated hashes or signed revision records, for authoritative project and decision files.
7. Remove unconditional authority from project files. Require reconciliation against the current user's instructions and confirmation before consequential actions.
8. Display newly loaded or materially changed memory to the user when it would affect tool use, disclosure, deletion, external communication, or other sensitive actions.
9. Maintain version history and provide a rollback mechanism so poisoned entries can be identified and removed from active and archived records.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to create and maintain persistent memory files across sessions without any consent, scoping, or sensitivity guardrails. This creates a privacy and data-retention risk because user content may be stored indefinitely in the workspace, including secrets, personal data, or confidential project details the user did not expect to persist.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instruction to 'write everything down' encourages indiscriminate persistence of session content, which can capture credentials, API keys, personal information, internal business data, or other sensitive material. In a memory skill specifically designed for long-term retention and indexing, this broad collection behavior substantially increases the chance of later exposure or misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The archival, pruning, and compaction workflow directs the agent to reorganize and modify existing memory records automatically, but does not require confirmation or explain that existing files may be changed or moved. That can lead to unintended data loss, silent mutation of records, or user confusion about what information was retained, pruned, or archived.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The unqualified rule to log anything that 'matters enough to say' is effectively an instruction to persist user-provided information based on subjective importance rather than privacy or necessity. Given the skill’s append-only logs, indexing, and archival behavior, sensitive details may be widely replicated across files and retained long term, increasing disclosure risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.