Customer Memory

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:19 AM UTC
• Version: 1.0.0

Overview

This skill stores customer history in BlueColumn as advertised, but it needs review because it encourages persistent storage of identifiable customer data without clear privacy, retention, or access safeguards.

Install only if your organization has approved BlueColumn for customer-data processing. Before use, define what may be stored, redact secrets and sensitive personal data, prefer opaque customer IDs over emails, restrict recall to the current tenant and customer, and establish retention, deletion, and access-review procedures.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:19

Finding

Customer PII Is Persisted to an External Service Without Data-Handling Safeguards

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:19-36, SKILL.md:44-59
Vulnerability Type: External persistence of sensitive customer information without consent, minimization, or retention controls
Risk Level: Medium

The documented workflows instruct the agent to transmit customer email addresses, support history, preferences, plan information, and technical-stack details to BlueColumn's externally hosted persistent-memory service.

markdown

## Store Customer Interaction

```bash
curl -X POST .../agent-remember \
  -H "Authorization: Bearer <key>" \
  -d '{
    "text": "Customer: [e-mail]. Issue: API rate limiting on Developer plan. Resolved by upgrading to Builder. Prefers email communication. Tech stack: Python + LangChain.",
    "title": "Customer: [e-mail] - 2026-04-14"
  }'

Store Quick Customer Note

bash

curl -X POST .../agent-note \
  -H "Authorization: Bearer <key>" \
  -d '{
    "text": "[e-mail] prefers async email over live chat",
    "tags": ["customer", "[e-mail]", "preference"]
  }'

text

The required workflow further encourages routine collection and persistence:

```markdown
## Workflow

**New interaction:**
1. Query customer history first: "what do we know about [customer]?"
2. Use context to personalize response
3. After interaction → store summary via `/agent-remember`
4. Store key preferences via `/agent-note` with customer email tag

**Support ticket:**
1. Recall similar past issues: "have we seen this error before?"
2. Resolve using historical context
3. Log resolution with outcome

## Title Convention
`"Customer: <email> - <YYYY-MM-DD>"`

Use consistent email-based naming so recall queries work accurately across all interactions with the same customer.

Technical Analysis

Customer data is sent to https://xkjkwqbfvkswwdmbtndo.supabase.co/functions/v1 and stored as searc ...[truncated 2571 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit customer and organizational authorization before enabling persistent storage.
2. Add a mandatory preprocessing stage that removes passwords, API keys, session tokens, payment data, government identifiers, health information, and other sensitive fields.
3. Replace email-based titles and tags with opaque, tenant-scoped customer identifiers.
4. Define an allowlist of fields that may be stored rather than accepting unrestricted interaction summaries.
5. Require confirmation before persisting unusually sensitive or high-volume content.
6. Document retention periods, deletion procedures, data residency, subprocessors, and incident-response responsibilities.
7. Provide API operations or administrative procedures for customer-specific export and deletion.
8. Scope API keys per environment and tenant, rotate them regularly, and never include them in logs or stored memory.
9. Warn agents not to persist entire transcripts by default; store only the minimum operational facts necessary.

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:44

Finding

Untrusted Interaction Content Can Poison Persistent Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:44-54; references/api.md:14-36
Vulnerability Type: Persistent ingestion and reuse of attacker-controlled content without trust boundaries
Risk Level: Medium

The Skill instructs the agent to store interaction summaries and automatically consult the resulting memory in later workflows:

markdown

## Workflow

**New interaction:**
1. Query customer history first: "what do we know about [customer]?"
2. Use context to personalize response
3. After interaction → store summary via `/agent-remember`
4. Store key preferences via `/agent-note` with customer email tag

**Support ticket:**
1. Recall similar past issues: "have we seen this error before?"
2. Resolve using historical context
3. Log resolution with outcome

The API accepts unrestricted text and returns an AI-generated answer from semantically selected memory:

markdown

## POST /agent-remember

Ingest text, audio URL, or file URL into vector memory.

**Fields:**
- `text` (string) — raw text to ingest ← use this for most cases
- `audio_url` (string) — URL to audio file (Whisper transcription)
- `file_url` (string) — URL to PDF/document
- `title` (string, optional) — title hint

**Response:** `{ success, session_id, title, summary, action_items, key_topics, chunk_count, queryable }`

## POST /agent-recall

Query memory with natural language, returns AI-generated answer + sources.

**Fields:**
- `q` (string, required) — natural language query

**Response:** `{ answer, sources: [{ session_id, title, relevance }], tokens_used }`

Technical Analysis

Customer interaction text is attacker-influenceable. Persisting it in vector memory creates a cross-session trust problem: instruction-like text, fabricated customer facts, or malicious support guidance can survive the original interaction and later be selected through semantic similarity.

The Skill does not instruct the ...[truncated 3131 chars]

Remediation

View remediation

Remediation Suggestions

1. Explicitly classify all customer-supplied and recalled memory as untrusted data, never as executable instructions.
2. Add an ingestion filter that detects and removes prompt-injection phrases, tool-use directives, policy overrides, and requests to alter future agent behavior.
3. Store customer statements as quoted claims with provenance rather than as verified facts.
4. Require tenant-scoped and customer-scoped identifiers for every write and recall operation.
5. Replace broad semantic queries with filtered retrieval constrained to the current tenant, customer, data type, and permitted time range.
6. Validate security-sensitive recalled claims against authoritative CRM, identity, entitlement, or ticketing systems before taking action.
7. Include provenance, creation time, author, confidence, review status, and expiration metadata in every stored record.
8. Prevent recalled content from changing system instructions, authorizing tool calls, weakening verification, or selecting external recipients.
9. Require human approval for sensitive actions influenced by persistent memory.
10. Add poisoning tests that store adversarial instructions and confirm they are either rejected or rendered inert during future recall.
11. Ensure recall responses clearly separate generated summaries from verbatim sources and expose only records authorized for the current customer context.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill’s core purpose is persistent storage and recall of customer interaction data, including identifiable and potentially sensitive operational details. Without strict guardrails, this creates a durable memory layer that can leak, over-collect, or surface customer data beyond the original purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs agents to store and recall customer emails, preferences, issues, and account history but does not warn about consent, data minimization, retention, or legal/privacy obligations. This omission makes it easy for downstream agents to process sensitive customer data in ways that violate policy or regulation.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The example payloads explicitly direct the agent to send identifiable customer data, support issues, preferences, and plan information to an external memory service. These examples normalize storing raw PII in plain text and tags, increasing the risk of exposure, misuse, and over-retention.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The workflow operationalizes a loop of recalling prior customer history, personalizing responses from it, and then storing new summaries after every interaction. This creates continuous accumulation of customer profiles and increases the chance of inappropriate reuse, profiling, or disclosure of historical data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough to activate on ordinary support or CRM-related language, increasing the chance an agent will invoke persistent storage and recall without a deliberate privacy decision. In this skill’s context, that can cause unintended collection or reuse of customer PII and interaction history.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The skill sends customer data to an external Supabase-hosted backend, which is a real external transmission boundary even if it is described as the official service. Because the transmitted payload includes customer PII and account history, compromise, misconfiguration, or unauthorized use of that external service could expose sensitive data.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

Store Customer Interaction

bash

curl -X POST .../agent-remember \
  -H "Authorization: Bearer <key>" \
  -d '{
    "text": "Customer: [e-mail]. Issue: API rate limiting on Developer plan. Resolved by upgrading to Builder. Prefers email communication. Tech stack: Python + LangChain.",

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Using customer email addresses as persistent titles and tags creates a stable identifier that is easy to correlate across records and difficult to minimize later. This increases privacy risk, makes accidental disclosure more harmful, and can complicate deletion or data-subject request handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The endpoint documentation explicitly encourages ingestion of raw text, audio URLs, and file URLs into persistent vector memory, but provides no privacy, consent, retention, or data-minimization warning. In a customer-memory skill, this omission is security-relevant because agents may store sensitive customer data, support transcripts, or regulated information without operators realizing the privacy and disclosure risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The recall endpoint is described as taking a natural-language query and returning an AI-generated answer plus sources, but it does not warn that queries operate over retained customer memory and may surface previously stored sensitive content. This is dangerous in context because an agent developer may treat recall as harmless search, when it can re-expose customer data to users, logs, or downstream systems.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.