other
Warning
- Location
- SKILL.md:8
- Finding
- Automatic External Persistence of Sensitive Family Information Without Explicit Consent## Vulnerability Details **File Location**: `SKILL.md`, lines 8-38 **Vulnerability Type**: Sensitive Data Overcollection and External Persistence **Risk Level**: Medium ### Vulnerable Code ```markdown ## Setup Read `TOOLS.md` or the platform secret store for the BlueColumn API key (`bc_live_*`). Base URL: `https://xkjkwqbfvkswwdmbtndo.supabase.co/functions/v1` ## Store ```bash curl -X POST .../agent-remember \ -H "Authorization: Bearer <key>" \ -H "Content-Type: application/json" \ -d '{"text": "Mom's birthday Aug 2. Kid's school event 8/10.", "title": "family-memory - note"}' ``` ## Workflow 1. On new context, first recall: `What family dates are coming up?` 2. Use the answer to personalize the response 3. After the interaction, store the summary via `/agent-remember` ``` ### Technical Analysis The skill instructs the agent to obtain an API credential from the platform secret store and use it to send family information to an externally hosted persistent-memory service. The mandatory workflow directs the agent to store a summary after an interaction without requiring explicit, per-write user consent. Interaction summaries can contain sensitive personal information, including names, family relationships, birthdays, school events, locations, health details, or unrelated information disclosed during the conversation. The instructions do not define data-minimization rules, prohibited data classes, redaction requirements, retention limits, deletion procedures, or a confirmation step showing the user exactly what will be transmitted. Although external persistent storage is the stated purpose of the skill, automatic summary storage creates a privacy and data-governance risk because users may not expect every interaction to be transmitted and retained. No evidence indicates that the skill executes remote code, steals the API credential, escalates system privileges, or installs persistence on the ...[truncated 1267 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit user confirmation before every persistent write and display the exact content that will be transmitted. 2. Replace automatic post-interaction summary storage with an opt-in action initiated by a clear user request. 3. Apply strict data minimization by storing only facts specifically selected by the user rather than complete interaction summaries. 4. Redact credentials, authentication tokens, financial information, health information, precise locations, and information about minors unless storage is necessary and expressly authorized. 5. Clearly identify the external destination, intended use, retention period, and applicable deletion mechanism before transmission. 6. Provide commands or documented procedures to inspect, correct, export, and permanently delete stored records. 7. Define retention limits and prevent indefinite storage by default. 8. Limit the API key to only the required memory endpoints and operations, rotate it regularly, and never include it in logs or stored summaries. 9. Validate recall results before using them, label retrieved information as externally stored memory, and avoid treating recalled content as trusted instructions.