T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:29- Finding
Unredacted screenshot text may be transmitted to external search services
- Content
View full analysis
- Remediation
View remediation
Security audit
Meme Analyst
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real meme-analysis workflow, but it can search private screenshot text, ingest Telegram media on a cron path, and persist user or channel-derived content without clear consent or retention controls.
Review before installing. Use this only where external web searches, Telegram channel media ingestion, and persistent meme-analysis memory are acceptable. Avoid private screenshots or sensitive chats unless the operator adds a consent/redaction step and reviews or limits what is saved under memory/memes.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:92- Finding
Untrusted user explanations are persisted and reused without validation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill directs the agent to store user-provided explanations in a persistent knowledge base without any explicit notice or consent step. Persisting conversational content can expose personal data, sensitive opinions, or copyrighted text beyond the user’s expectations, especially if later reused in other contexts.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The cron workflow collects, downloads, analyzes, and stores Telegram channel content without a visible privacy notice, purpose limitation, or retention policy. Even if channels are public, automated bulk processing and cross-channel state tracking can create significant privacy, legal, and operational risk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The activation text is broad enough to trigger on many ordinary image, joke, screenshot, or explanation requests. Over-broad invocation can route unrelated user content into a skill that performs web searches and persistence, causing unnecessary data exposure and surprising behavior.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill’s documented scope expands beyond transient meme explanation into persistent knowledge-base management. That changes the trust and data-handling model: a user invoking a meme explainer may not expect their content or derived analysis to be retained long-term, which increases privacy, retention, and governance risk.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Instructing the agent to retain user-provided explanations in long-term memory is a direct persistent-storage behavior that may capture sensitive or identifying information. The danger is amplified because the instruction is framed as routine operational behavior rather than an exceptional, consented action.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The cron-ingestion section materially broadens the skill from interactive analysis to autonomous collection, downloading, processing, and storage of Telegram channel content. This creates a larger attack and compliance surface because the agent is now performing background surveillance-like ingestion and maintaining state across channels without clear guardrails.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The interactive workflow tells the agent to store explanations received in chat, which means ordinary user interaction can silently become training-like memory capture. This violates least surprise and can propagate sensitive or contextual data into future sessions or analyses.
- Content
Behavior Manipulation
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Subtle instructions detected that may alter agent decision-making or introduce hidden biases.
- Content
md ## Cost Awareness - Image analysis uses vision tokens: ~1,590 tokens per 1092x1092 image - Web searches are cheap — always prefer researching over guessing - Don't analyze the same meme template 50 times — after 3-5 examples of the same template, just log new instances - During cron ingestion, skip memes that are clearly reposts of already-analyzed content
Static analysis
No suspicious patterns detected.