Security audit
Security checks for vulnerabilities and agentic risk
This skill is purpose-built for coaching memory, but it tells agents to automatically store and recall coaching notes in an external service without clear user consent, minimization, or retention guidance.
Install only if you are comfortable with coaching summaries and progress notes being sent to BlueColumn for persistent recall. Avoid storing sensitive personal details unless the user explicitly agrees, and prefer brief redacted summaries until retention and deletion controls are clear.
The skill instructs agents to persist coaching notes and progress data to an external BlueColumn service but does not warn that this may include sensitive personal, behavioral, or goal-tracking information. In a coaching context, users may disclose highly sensitive material, so omitting disclosure and consent guidance creates a real privacy and data-handling risk.
The skill explicitly sends user coaching content to a remote endpoint using authenticated POST requests. While external transmission is core to the feature, it is still a genuine security/privacy concern because the transmitted content can contain sensitive personal progress notes, and the workflow encourages automatic recall and storage without any stated minimization or consent checks.
curl -X POST .../agent-remember \
-H "Authorization: Bearer <key>" \
-H "Content-Type: application/json" \
-d '{"text": "Goal: ship MVP by Sep. Check-in 7/31: on track, risk — design sign-off.", "title": "coaching-memory - note"}'