Security audit

bluecolumn-memory

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed BlueColumn memory integration, but users should be careful because it can persist selected data to an external service.

Install this only if you intend to use BlueColumn as an external persistent memory service. Use the platform secret store for the BlueColumn API key when possible, avoid the plaintext TOOLS.md fallback, and only allow the agent to store content you deliberately want retained and searchable later. Be especially cautious with conversations, documents, audio, credentials, regulated data, and third-party private information.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The skill description is broad enough to trigger on generic requests about remembering, recalling, notes, conversations, and documents, which can cause the agent to invoke this skill outside a narrowly user-intended BlueColumn context. In practice, this increases the chance of unnecessary third-party data transmission and secret-handling paths being activated for ordinary memory-related tasks.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The guidance explicitly encourages the agent to save its own observations and to write after meaningful exchanges or at session end, but it does not require explicit user consent for those autonomous writes. That creates a real risk that agents will persist preferences, decisions, summaries, or sensitive conversational context to an external service without the user's informed approval.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation explicitly instructs agents to ingest text, audio URLs, and file URLs into persistent vector memory but does not warn that user data will be retained, indexed, and later queryable. In a memory skill, this omission is risky because agents may send sensitive conversations, documents, or third-party content to remote storage without informed user consent or data-minimization safeguards.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The /agent-note endpoint is described as storing lightweight observations as searchable vectors, but the docs do not disclose persistence, discoverability, or privacy implications of those notes. Because this skill is specifically designed for agent memory, even small observations can include sensitive user traits, internal reasoning, or credentials that become retrievable later.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:14