Meme Analyst

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:42 PM UTC
• Version: 1.1.0

Overview

The skill is a real meme-analysis workflow, but it can search private screenshot text, ingest Telegram media on a cron path, and persist user or channel-derived content without clear consent or retention controls.

Review before installing. Use this only where external web searches, Telegram channel media ingestion, and persistent meme-analysis memory are acceptable. Avoid private screenshots or sensitive chats unless the operator adds a consent/redaction step and reviews or limits what is saved under memory/memes.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:29
• Finding: Unredacted screenshot text may be transmitted to external search services<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 29-33 **Vulnerability Type**: Sensitive information disclosure through external search **Risk Level**: Medium ### Vulnerable Code ```markdown 1. **Search the exact text** — Copy the quote or phrase and web_search it. Memes frequently reference: - Political speeches and statements - Movie/TV/anime quotes - Song lyrics - Famous tweets or social media posts ``` ### Technical Analysis The Skill activates for memes, images, and arbitrary screenshots. It instructs the Agent to copy exact text from those inputs and submit it through `web_search`. Screenshots can contain private conversations, names, email addresses, account identifiers, authentication material, internal URLs, or other sensitive information unrelated to meme analysis. The instruction does not require the Agent to: - Determine whether the screenshot is public or private. - Detect credentials, personal data, or confidential content. - Redact identifiers before searching. - Obtain user consent before transmitting extracted text. - Limit searches to the smallest non-sensitive phrase necessary. Searching public cultural references is consistent with the declared meme-analysis functionality. However, mandatory exact-text searching exceeds minimum necessary privilege where a sanitized phrase, local analysis, or explicit user confirmation would suffice. ### Attack Path 1. A user submits a screenshot containing both an unfamiliar phrase and sensitive information. 2. The Skill decomposes the screenshot and identifies the text as a possible cultural reference. 3. Following the instruction to copy and search the exact text, the Agent submits that content to an external search service. 4. The search provider receives and may log the submitted content. 5. Depending on tool implementation, the query may also be exposed to downstream search infrastructure or visited websites. No arbitrary code execution or system privilege es ...[truncated 716 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace exact-text searching with a data-minimizing workflow: - Extract only the smallest phrase needed to identify the reference. - Remove names, handles, email addresses, phone numbers, URLs, and unique identifiers. - Never search credentials, tokens, recovery codes, or private-message content. 2. Add a sensitivity gate before every external search: - Classify the image as public meme content or potentially private content. - Ask for explicit user consent before searching text from private screenshots. - Default to local analysis when classification is uncertain. 3. Restrict search construction: - Use sanitized keywords rather than entire quotes when possible. - Permit exact-phrase searches only after confirming that the phrase is public and non-sensitive. - Record what sanitized query will be submitted when user approval is required. 4. Document the network boundary clearly: - State that search queries are sent to an external provider. - Identify applicable retention and privacy considerations. - Avoid forwarding the source image unless separately required and approved. ]]>

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:92
• Finding: Untrusted user explanations are persisted and reused without validation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 92-97 **Vulnerability Type**: Persistent memory poisoning **Risk Level**: Medium ### Vulnerable Code ```markdown If after researching you still don't understand: - Say what you DO understand - Identify the specific gap: "I found the quote is from X, but I don't understand why combining it with Y is funny" - Ask the user to explain - **Store their explanation** in the knowledge base for future reference ``` Related persistence instructions later reinforce this behavior: ```markdown If the user explains: thank them, store the explanation, update the knowledge base ``` ### Technical Analysis The Skill explicitly directs the Agent to store user-provided explanations in persistent knowledge-base files and later retrieve stored material through `memory_search`. User explanations are attacker-controlled input, but the Skill defines no validation, provenance tracking, trust level, content normalization, or separation between factual reference data and operational Agent instructions. An attacker can therefore provide an explanation containing: - Deliberately false cultural or political claims. - Instruction-like text directed at the Agent. - Misleading search guidance. - Content crafted to affect future analyses when retrieved. - Hostile data intended to be mistaken for trusted Skill instructions. Persistence creates a cross-session trust-boundary problem. Although the reviewed text does not explicitly direct the Agent to execute stored commands, future retrieval can place malicious content into the Agent's context and influence its responses. ### Attack Path 1. The attacker submits a meme or screenshot containing an obscure or fabricated reference. 2. The Agent cannot resolve the reference and asks the attacker to explain it. 3. The attacker supplies a crafted explanation containing misinformation or embedded Agent-directed instructions. 4. Following the Skill, the Agent stores the expla ...[truncated 1084 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat all user explanations as untrusted data: - Never interpret stored explanation text as Agent instructions. - Delimit retrieved content clearly as untrusted reference material. - Reject or escape role directives, tool commands, and instruction-like content. 2. Require verification before promotion into trusted memory: - Corroborate factual claims using independent reputable sources. - Mark unverified explanations as user-supplied hypotheses. - Prevent unverified entries from becoming canonical references. 3. Store structured records rather than unrestricted Markdown: - Use fixed fields such as `claim`, `source`, `submitted_by`, `timestamp`, `verification_status`, and `confidence`. - Restrict field lengths and accepted character patterns. - Keep operational instructions outside all user-writable fields. 4. Add provenance and isolation: - Associate each entry with its originating user, channel, and message. - Avoid sharing unverified memory across unrelated users or channels. - Apply access controls to memory update and deletion operations. 5. Provide lifecycle controls: - Require review before persistent storage. - Support correction, quarantine, expiration, and deletion. - Log memory modifications so poisoned entries can be traced and removed. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The skill directs the agent to store user-provided explanations in a persistent knowledge base without any explicit notice or consent step. Persisting conversational content can expose personal data, sensitive opinions, or copyrighted text beyond the user’s expectations, especially if later reused in other contexts.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The cron workflow collects, downloads, analyzes, and stores Telegram channel content without a visible privacy notice, purpose limitation, or retention policy. Even if channels are public, automated bulk processing and cross-channel state tracking can create significant privacy, legal, and operational risk.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The activation text is broad enough to trigger on many ordinary image, joke, screenshot, or explanation requests. Over-broad invocation can route unrelated user content into a skill that performs web searches and persistence, causing unnecessary data exposure and surprising behavior.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill’s documented scope expands beyond transient meme explanation into persistent knowledge-base management. That changes the trust and data-handling model: a user invoking a meme explainer may not expect their content or derived analysis to be retained long-term, which increases privacy, retention, and governance risk.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: Instructing the agent to retain user-provided explanations in long-term memory is a direct persistent-storage behavior that may capture sensitive or identifying information. The danger is amplified because the instruction is framed as routine operational behavior rather than an exceptional, consented action.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The cron-ingestion section materially broadens the skill from interactive analysis to autonomous collection, downloading, processing, and storage of Telegram channel content. This creates a larger attack and compliance surface because the agent is now performing background surveillance-like ingestion and maintaining state across channels without clear guardrails.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The interactive workflow tells the agent to store explanations received in chat, which means ordinary user interaction can silently become training-like memory capture. This violates least surprise and can propagate sensitive or contextual data into future sessions or analyses.

Behavior Manipulation

Medium

• Category: Prompt Injection

Content

## Cost Awareness

- Image analysis uses vision tokens: ~1,590 tokens per 1092x1092 image
- Web searches are cheap — always prefer researching over guessing
- Don't analyze the same meme template 50 times — after 3-5 examples of the same template, just log new instances
- During cron ingestion, skip memes that are clearly reposts of already-analyzed content

• Confidence: 70% confidence
• Finding: Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Static analysis

No suspicious patterns detected.