Security audit

Agent Journal

Security checks for vulnerabilities and agentic risk

Overview

This skill provides a real external persistent memory feature, but it is broad enough to store user and session details without clear consent, redaction, retention, or deletion controls.

Install only if you are comfortable with selected conversation details being sent to BlueColumn's external service and retained for future recall. Use explicit consent before storing entries, avoid secrets or regulated data, review summaries before submission, and confirm how stored memories can be inspected, corrected, deleted, and how the API key can be revoked.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

other

Warning

Location: SKILL.md:8
Finding: Potentially Sensitive User Context Is Persisted to an External Service Without Explicit Consent Controls
Content: View full analysis
" \ -d '{"text": "User prefers bullet points over paragraphs", "tags": ["preference", "style"]}' ``` ```bash curl -X POST .../agent-remember \ -H "Authorization: Bearer " \ -d '{"text": "Session summary: user is building a SaaS product in Phoenix. Decided on PostgreSQL. Main concern is scalability.", "title": "Session Log 2026-04-14"}' ``` ```markdown ## Journaling Workflow **Start of session:** Recall relevant context: - "What do I know about this user?" - "What were we working on last time?" **During session:** Note important observations via `/agent-note` **End of session:** Summarize and store via `/agent-remember` ``` ### Technical Analysis The Skill directs the agent to transmit observations, preferences, decisions, project details, and session summaries to a fixed external Supabase Edge Functions endpoint. Although this external persistence is disclosed and is central to the Skill's stated purpose, the workflow does not require explicit user consent before each transmission and does not define controls for sensitive-data classification, redaction, retention, deletion, or data minimization. The recommended start-, during-, and end-of-session workflow normalizes routine persistence. Consequently, confidential informat ...[truncated 1573 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:38
Finding: Persistent Journal Entries Can Create a Cross-Session Memory-Poisoning Channel
Content: View full analysis
" \ -d '{"q": "what does the user prefer for formatting?"}' ``` ## When to Use Each | Situation | Endpoint | |---|---| | Quick preference or observation | `/agent-note` | | End-of-session summary | `/agent-remember` | | Retrieving past context | `/agent-recall` | ## Journaling Workflow **Start of session:** Recall relevant context: - "What do I know about this user?" - "What were we working on last time?" **During session:** Note important observations via `/agent-note` **End of session:** Summarize and store via `/agent-remember` ``` The corresponding API behavior is documented in `references/api.md:25-30`: ```markdown ## POST /agent-recall Query memory with natural language, returns AI-generated answer + sources. **Fields:** - `q` (string, required) — natural language query **Response:** `{ answer, sources: [{ session_id, title, relevance }], tokens_used }` ``` ### Technical Analysis The Skill permits user-derived text to be stored through `/agent-note` and `/agent-remember`, and it recommends retrieving that content at the beginning of later sessions. However, it does not establish a trust boundary between recalled data and executable agent instructions. An attacker or untrusted user could ask the agent to remember text containing instruction-like rules, false preferences, or directives. Once persisted, semantically related recall queries may cause the external service to return that content, potentially as part of an AI-generated answer. If the consuming agent treats the response as authoritative instructions rather than untrusted reference data, the content may affect behavior in future sessions. This cr ...[truncated 1763 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad enough to activate on common conversation such as 'remember for later' or 'note this down', which can cause the skill to capture and persist user or session data without a sufficiently explicit journaling intent. Because this skill stores data across sessions in an external memory service, accidental invocation increases the risk of oversharing sensitive information and creating unintended long-term records.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill describes persistent journaling but does not clearly and prominently warn that user/session content is transmitted to an external third-party backend and retained for future recall. This omission can lead agents or users to treat journaling as an internal note-taking action when it is actually external persistent storage, creating meaningful privacy, consent, and data-handling risks.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: The documented workflow sends free-form text such as user preferences and session summaries to an external API endpoint using an authorization token, which is a real data exfiltration channel by design. In this context the transmission is the feature, but it still creates security risk because the examples encourage storing potentially sensitive behavioral and project information outside the local agent environment.
Content: Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.
For lightweight agent observations — preferences, patterns, decisions:

bash
curl -X POST .../agent-note \ -H "Authorization: Bearer <key>" \ -d '{"text": "User prefers bullet points over paragraphs", "tags": ["preference", "style"]}'

Static analysis

No suspicious patterns detected.