T09 · Insecure Skill Coding Practices
Warning
- Location
references/starter-patterns.md:9- Finding
Unfiltered User Data May Be Persisted in Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
Battle-Tested Agent
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent agent-reliability toolkit, but some recommended memory and self-improvement patterns can persist sensitive user content and promote future agent rules without enough review controls.
Review this skill carefully before installing. The audit script appears low risk, but do not adopt the WAL or auto-promotion patterns as written in a real workspace. Require explicit user approval before retaining personal or sensitive information, redact secrets and private links, set retention/deletion rules, and make all SOUL.md or AGENTS.md changes human-reviewed rather than automatic.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T02 · Agent Memory Poisoning
Error
- Location
references/advanced-patterns.md:154- Finding
User-Influenced Learnings Can Be Promoted into Persistent Agent Instructions
- Content
View full analysis
Insights, corrections, and best practices. Promote recurring patterns to SOUL.md or AGENTS.md. ``` ```markdown > Track failures and their fixes. Patterns here become prevention rules in SOUL.md. ``` ### Technical Analysis The self-improvement workflow allows recurring learning entries to be promoted into `SOUL.md` or `AGENTS.md`, which are persistent and potentially authoritative agent instruction files. The recurrence threshold measures repetition but does not establish that an entry is trustworthy or safe. The design lacks mandatory controls for: - Human approval before modifying authoritative instruction files. - Provenance tracking for the original observation. ...[truncated 2948 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 75% confidence
- Finding
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
- Content
Working Buffer
When context is getting long:
- Append key exchanges to memory/working-buffer.md
- After compaction: read buffer FIRST, extract context, then clear
text Suggested thresholds:
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill description uses broad activation language such as "my agent is unreliable" and "how do I make this more robust," which can match many ordinary conversations and cause the skill to be invoked outside a clearly scoped hardening context. In agent systems that auto-select skills from descriptions, this can lead to over-triggering, unnecessary workflow changes, or accidental insertion of prescriptive operational behavior into unrelated tasks.
- Content
Persistent Context Injection
Medium
- Category
- Memory Poisoning
- Confidence
- 87% confidence
- Finding
The pattern explicitly instructs the agent to auto-promote repeated learnings into persistent files like SOUL.md/AGENTS.md as permanent rules. That creates a persistent context injection path: if bad, low-quality, or adversarially induced 'learnings' are logged often enough, they can become long-lived instructions that influence future behavior beyond the original task. In a reliability-focused agent skill, this is more dangerous because the mechanism is presented as a normal hardening practice and may be broadly adopted without strong trust or review controls.
- Content
- First-Seen / Last-Seen: date range
Auto-Promotion Rule: 3+ occurrences across 2+ tasks in 30 days → promote to SOUL.md/AGENTS.md as permanent rule.
text Recommended logging destinations:
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The WAL guidance instructs the agent to write to memory whenever a message contains broad categories like proper nouns, preferences, decisions, or exact values, without requiring relevance, consent, sensitivity checks, or data-minimization constraints. In a production hardening skill, this can normalize over-collection and persistence of user data, causing privacy leakage, retention of secrets, or unintended cross-task influence if the memory store is later reused.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The embedded prompt strengthens the risky behavior by using absolute activation language: 'When the human's message contains ANY of these, WRITE to daily memory BEFORE responding.' That wording removes operator judgment and encourages automatic storage of potentially sensitive content simply because it matches a category, which is especially dangerous in a reusable skill intended for broad deployment across agent frameworks.
- Content
Static analysis
No suspicious patterns detected.