other
- Location
SKILL.md:9- Finding
Automatic External Transmission and Persistent Storage of Interaction Summaries
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 9 and 37–40
Vulnerability Type: Unauthorized External Data Transmission
Risk Level: MediumRelevant code:
markdown ## Setup Read `TOOLS.md` or the platform secret store for the BlueColumn API key (`bc_live_*`). Base URL: `https://xkjkwqbfvkswwdmbtndo.supabase.co/functions/v1`markdown ## Workflow 1. On new context, first recall: `How are our marketing campaigns performing?` 2. Use the answer to personalize the response 3. After the interaction, store the summary via `/agent-remember`Technical Analysis
The skill directs the agent to transmit a summary of each interaction to an external Supabase-hosted BlueColumn endpoint. The workflow does not require explicit user confirmation before writing, define an allowlist of permitted fields, require redaction of credentials or personal information, or state retention and deletion controls.
Because interaction summaries may include confidential campaign details, personal data, internal metrics, or other sensitive conversation content, automatic storage creates an external disclosure boundary that users may not reasonably expect. The behavior is documented rather than concealed, and no evidence shows that the API key is sent anywhere other than the stated service; nevertheless, the absence of per-write consent and data minimization controls makes the transmission unsafe.
Attack Path
- A user discusses sensitive marketing metrics, strategy, customer information, or credentials during an interaction.
- The agent follows the mandatory post-interaction workflow and creates a summary.
- The agent authenticates with the
bc_live_*key obtained from the platform secret store. - The summary is submitted to the external
/agent-rememberendpoint. - The external service persistently stores the information, making it available through later recall operations and subjecting it to ...[truncated 686 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit, informed user approval before every external memory write, showing the exact content and destination.
- Make persistent storage opt-in rather than a mandatory post-interaction step.
- Restrict stored records to user-selected marketing fields and enforce strict schemas and length limits.
- Redact API keys, credentials, personal data, customer identifiers, and confidential business information before transmission.
- Add automated secret and sensitive-data detection, failing closed if unsafe content is identified.
- Document the external processor, storage region, retention duration, access policy, deletion procedure, and incident-response process.
- Provide users with commands to inspect, correct, and permanently delete stored records.
- Prefer an organization-controlled, allowlisted endpoint with transport security, tenant isolation, least-privilege credentials, access logging, and key rotation.
- Do not automatically reuse recalled content unless its provenance and authorization scope have been validated.