aatmf-t04-memory-manipulation

AATMF T4 — Multi-Turn & Memory Manipulation. Persistent memory injection, conversation-state poisoning, cross-session contamination, ghost-context leak.

Quality

62%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Critical

Do not install without reviewing

Fix and improve this skill with Tessl

tessl review fix ./packages/decepticon/decepticon/skills/plugins/llm-redteam/t04-memory-manipulation/SKILL.md

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a lean, well-organized technique catalog with concrete attack payloads, but its test-harness guidance is incomplete and lacks validation checkpoints, and no bundle files support progressive disclosure.

Suggestions

Provide an executable multi-turn test harness example (e.g. a python_provider script) rather than describing it abstractly, and supply the referenced 'custom-policy' instead of leaving it dangling.

Add explicit validation/detection steps to the probe workflow — how to confirm an injected instruction persisted across sessions and triggered.

Move the custom-policy definition and any extended payload examples into a referenced reference file to enable one-level-deep progressive disclosure.

Dimension	Reasoning	Score
Conciseness	The body is lean throughout — terse technique descriptions, lists, and abbreviations ('w/', '→') with only a one-line non-padded intro; it assumes Claude's competence and never lectures on what LLMs or memory are, matching the score-3 'every token earns its place' anchor.	3 / 3
Actionability	Concrete attack payloads and a YAML probe block are copy-paste ready, but the multi-turn test harness is only described abstractly ('Use the python_provider to script multi-turn scenarios') with no executable script and a dangling 'see custom-policy' reference, leaving key guidance incomplete per the score-2 anchor.	2 / 3
Workflow Clarity	The Techniques → Probe → Detection → Severity → Defender structure gives an implicit sequence, but there are no explicit validation checkpoints for confirming a memory injection actually persisted, which is the score-2 'sequence present but checkpoints missing' case rather than score-3.	2 / 3
Progressive Disclosure	No bundle files exist and all ~90 lines live in a single inline SKILL.md with no external references, so content that could be split (e.g. the custom-policy or multi-turn harness) is inline — well-organized sections keep it above score-1 but it is not the score-3 one-level-deep-reference structure.	2 / 3
	Total	9 / 12 Passed

Description

60%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific and lists concrete techniques, but it relies on internal jargon and omits any explicit 'when to use' trigger clause, capping completeness at 2.

Suggestions

Add an explicit trigger clause, e.g. 'Use when testing LLM apps for memory-injection, conversation-poisoning, or cross-session contamination vulnerabilities.'

Replace or supplement coded jargon ('aatmf T4', 'ghost-context leak') with natural user terms like 'persistent memory, conversation history, RAG poisoning'.

Lead with a plain-language capability statement before the internal taxonomy ID to reduce overlap with sibling attack skills.

Dimension	Reasoning	Score
Specificity	Names the domain and lists multiple concrete techniques — 'Persistent memory injection, conversation-state poisoning, cross-session contamination, ghost-context leak' — matching the multi-action score-3 anchor rather than the single-action score-2 anchor.	3 / 3
Completeness	It clearly states what the skill covers but includes no 'Use when...' trigger guidance, which the rubric explicitly caps at 2 — it is not the score-1 case because the 'what' is explicit.	2 / 3
Trigger Term Quality	Terms like 'aatmf', 'T4', 'conversation-state poisoning', and 'ghost-context leak' are internal jargon a user would rarely say naturally; only 'memory injection' and 'cross session' are plausibly user-spoken, so it sits at 'some relevant keywords but missing common variations' rather than the full-coverage score-3.	2 / 3
Distinctiveness Conflict Risk	The memory-manipulation niche is fairly specific, but the coded 'aatmf T4' framing and jargon-heavy triggers mean it could overlap with adjacent attack skills and isn't the clear, naturally-triggered niche of score-3.	2 / 3
	Total	9 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
metadata_version	'metadata.version' is missing	Warning

	Total	15 / 16 Passed

Repository: PurpleAILAB/Decepticon
Path: packages/decepticon/decepticon/skills/plugins/llm-redteam/t04-memory-manipulation/SKILL.md
Commit: 4484f85

Reviewed: about 16 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.