thecede

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:25 PM UTC
• Version: 1.0.0

Overview

This memory skill is mostly coherent, but it explicitly encourages storing credentials in long-lived memory without safeguards.

Review before installing. This skill should be revised so agents never store passwords, API keys, access tokens, private keys, session cookies, recovery codes, or other secrets in Cortex. Use it only if the memory backend has clear user/project isolation, deletion controls, and policies that restrict storage to non-sensitive summaries or references to a separate secret manager.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:33

Finding

Persistent Storage of Credentials Is Explicitly Encouraged

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 33
Vulnerability Type: Sensitive credential retention in persistent memory
Risk Level: Medium

Vulnerable Code Snippet:

markdown

- Use `importance >= 0.7` for architectural decisions, credentials, project goals, user preferences.

Technical Analysis

The Skill explicitly identifies credentials as suitable content for persistent storage with an importance value of at least 0.7. According to the Skill's own description, higher-importance records are retained longer and weighted more heavily.

Stored nodes can subsequently be exposed to Agent context through cortex_search, cortex_recall, and the mandatory session-start cortex_briefing workflow. The document does not prohibit storing passwords, API keys, access tokens, private keys, session cookies, or recovery codes. It also provides no requirements for secret redaction, encryption, access control, tenant isolation, consent, retention limits, or secure deletion.

This is an insecure configuration and data-handling practice rather than evidence of deliberate exfiltration. No executable code, external endpoint, or malicious payload was identified in the audited project.

Attack Path

1. A user, tool response, configuration file, or task context exposes a credential to the Agent.
2. The Agent follows the Skill's guidance and submits the credential to cortex_store.
3. The credential is assigned an importance value of at least 0.7, increasing its retention and retrieval weight.
4. The persistent memory retains the secret across sessions.
5. A later cortex_briefing, cortex_search, or cortex_recall operation retrieves the stored credential into an Agent's active context.
6. The credential may then be disclosed in a response, exposed to a different task or user if isolation is inadequate, recorded in downstream logs, or misused by an actor with access to the memory system.

Imp

...[truncated 640 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the credential-storage instruction with an explicit prohibition against storing passwords, API keys, access tokens, private keys, session cookies, recovery codes, and other authentication secrets.
• Store only non-sensitive references or identifiers that point to secrets held in an approved secret manager.
• Implement secret detection and redaction before any content is passed to cortex_store.
• Reject storage when content matches known credential formats or contains high-entropy secret material.
• Encrypt persisted data in transit and at rest, with keys managed separately from the memory store.
• Enforce strict per-user, per-agent, and per-project access controls and isolation.
• Prevent briefings and broad semantic searches from returning sensitive fields.
• Apply short retention periods and low importance to sensitive non-secret information unless explicit user consent and a legitimate need exist.
• Provide auditable deletion and revocation workflows for mistakenly stored sensitive data.
• Document incident-response procedures requiring immediate deletion of an exposed secret and rotation or revocation of the original credential.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly recommends storing 'credentials' and 'user preferences' in persistent memory with elevated importance, but provides no safeguards, exclusions, redaction guidance, access controls, retention limits, or consent requirements. In a cross-session memory system, this creates a clear risk of secret retention, privacy leakage, and unintended reuse or disclosure of sensitive data across future sessions or contexts.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guidance normalizes persistent storage of sensitive information in a long-lived memory graph, which can cause durable exposure of credentials and personal data beyond the original task. Because the skill is specifically designed for cross-session recall and contextual retrieval, any stored secret may later be surfaced to the model or another workflow, amplifying confidentiality and privacy impact.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.