other
Warning
- Location
SKILL.md:8- Finding
Unconditional External Persistence of Sensitive Candidate and Interview Data
- Content
View full analysis
" \ -H "Content-Type: application/json" \ -d '{"text": "Candidate: Priya — applied 7/28, phone screen 8/3, strong on systems design.", "title": "hiring-memory - note"}' ``` ## Quick note ```bash curl -X POST .../agent-note \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{"text": "Candidate: Priya — applied 7/28, phone screen 8/3, strong on systems design.", "tags": ["hiring-memory"]}' ``` ## Recall ```bash curl -X POST .../agent-recall \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{"q": "What candidates are in the pipeline and where are they?"}' ``` ## Workflow 1. On new context, first recall: `What candidates are in the pipeline and where are they?` 2. Use the answer to personalize the response 3. After the interaction, store the summary via `/agent-remember` ``` ### Technical Analysis The skill directs the agent to transmit recruiting information to an external Supabase-hosted service and persist a summary after each interaction. The example records a candidate's name, application timeline, interview status, and qualitative assessment. Although this external persistence is consistent with the advertised memory functionality and is not covert, the workflow does not require: - Explicit authorization before an external write. - Data minimization or redaction. - Exclusion of protected attributes, contact information, or confidential interview feedback. - Tenant and record-level access validation before recall. - Defined retention and deletion c ...[truncated 2470 chars]- Remediation
View remediation