meeting-memory

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:22 AM UTC
• Version: 1.0.1

Overview

This skill does what it advertises, but it can automatically send and persist meeting content in an external BlueColumn service without clear consent, redaction, or trust-boundary guidance.

Install only if you are comfortable with meeting notes, queries, and summaries being sent to BlueColumn for persistent search. Avoid using it for confidential, regulated, credential-bearing, or internal-only discussions unless you have confirmed consent, retention, deletion, tenant isolation, and redaction practices.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:9

Finding

Automatic External Persistence of Potentially Sensitive Meeting Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:9-27, 37-40
Vulnerability Type: Uncontrolled external transmission and persistence of meeting data
Risk Level: Medium

Vulnerable Code Snippet

markdown

## Setup
Read `TOOLS.md` or the platform secret store for the BlueColumn API key (`bc_live_*`). Base URL: `https://xkjkwqbfvkswwdmbtndo.supabase.co/functions/v1`

## Store
```bash
curl -X POST .../agent-remember \
  -H "Authorization: Bearer <key>" \
  -H "Content-Type: application/json" \
  -d '{"text": "Meeting 7/30 standup: blockers — staging env down; owner: dev team.", "title": "meeting-memory - note"}'

Quick note

bash

curl -X POST .../agent-note \
  -H "Authorization: Bearer <key>" \
  -H "Content-Type: application/json" \
  -d '{"text": "Meeting 7/30 standup: blockers — staging env down; owner: dev team.", "tags": ["meeting-memory"]}'

text

```markdown
## Workflow
1. On new context, first recall: `What action items came out of the last standup?`
2. Use the answer to personalize the response
3. After the interaction, store the summary via `/agent-remember`

Technical Analysis

The skill instructs the agent to retrieve an API credential from TOOLS.md or the platform secret store and use it to transmit meeting notes and interaction summaries to an externally hosted Supabase endpoint. The workflow directs the agent to store a summary after an interaction without requiring explicit user confirmation.

Meeting data may contain personal information, credentials, internal infrastructure details, business plans, or other confidential material. No instructions require data classification, secret detection, redaction, minimization, tenant verification, or confirmation of the service's retention and deletion controls. Although external persistence is consistent with the advertised functionality, the absence of these safeguards creates an insecure data-handling bou ...[truncated 1061 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit, informed user approval before each external write, including a clear indication of the destination and the information to be stored.
• Add mandatory secret, credential, personal-data, and confidential-data detection and redaction before transmission.
• Store only the minimum fields necessary for meeting recall.
• Provide a local-only or no-persistence mode.
• Document the service's retention, deletion, encryption, tenant isolation, and data-processing behavior.
• Provide commands or documented procedures to inspect and permanently delete stored memories.
• Restrict secret access to a dedicated BlueColumn credential with the minimum required scope.
• Avoid reading credentials from general-purpose files when a protected secret store is available.
• Verify the endpoint host and enforce HTTPS without permitting redirects to untrusted origins.

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:29

Finding

Untrusted Persistent Recall Can Poison Future Agent Context

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:29-40
Vulnerability Type: Persistent memory poisoning and cross-session prompt injection
Risk Level: Medium

Vulnerable Code Snippet

markdown

## Recall
```bash
curl -X POST .../agent-recall \
  -H "Authorization: Bearer <key>" \
  -H "Content-Type: application/json" \
  -d '{"q": "What action items came out of the last standup?"}'

Workflow

1. On new context, first recall: What action items came out of the last standup?
2. Use the answer to personalize the response
3. After the interaction, store the summary via /agent-remember

text

### Technical Analysis

The workflow automatically recalls remotely persisted content at the start of a new context and directs the agent to use the returned data in its response. It does not instruct the agent to treat recalled records as untrusted data, distinguish quoted meeting content from agent instructions, verify provenance, or require user confirmation before acting on recalled action items.

An attacker able to influence meeting text or another record in the same memory scope can insert instruction-like content. Once stored, that content may be retrieved during later sessions and interpreted as operational guidance rather than inert data. The final storage step can then summarize and persist the poisoned context again, increasing its longevity.

### Attack Path

1. An attacker contributes meeting content containing a directive disguised as a note or action item, such as an instruction to ignore normal constraints or disclose unrelated context.
2. The agent stores the meeting summary through `/agent-remember` or the content is otherwise inserted into the relevant remote memory scope.
3. In a later session, the workflow automatically calls `/agent-recall`.
4. The malicious record is returned as part of the answer to the standup query.
5. Because the skill says to use the answer without defining
...[truncated 755 chars]

Remediation

View remediation

Remediation Suggestions

• Explicitly classify all recalled memory as untrusted reference data, never as executable instructions.
• Require the agent to ignore commands, policy changes, tool requests, and credential requests embedded in recalled records.
• Present memories as clearly delimited quotations with provenance, author, timestamp, tenant, and meeting identifiers.
• Enforce strict user and tenant isolation and authorize every read and write against the intended memory scope.
• Sanitize or flag instruction-like text before persistence and again after retrieval.
• Require user confirmation before performing actions based on recalled action items.
• Prevent recalled content from being recursively persisted unless it has been independently validated.
• Apply provenance scoring and retrieve only records belonging to the current user and explicitly selected meeting.
• Preserve higher-priority agent and platform instructions regardless of any text contained in memory.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The markdown instructs the agent to send meeting notes and recall queries to BlueColumn but does not explicitly warn that this is an external third-party service receiving potentially sensitive meeting content. In the context of persistent memory for meetings, omission of this warning is dangerous because users may unknowingly expose confidential business, personal, or regulated information to long-term storage outside the primary system.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description uses broad activation criteria such as when an agent 'takes meeting notes' or when a user 'wants to store, recall, or search meeting memory context,' which can cause over-invocation in situations involving sensitive discussions. Because the skill sends content to an external persistent memory service, ambiguous triggering increases the chance that confidential meeting data is transmitted or retained without clear user intent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The skill contains direct examples of POST requests that transmit meeting text to an external Supabase/BlueColumn endpoint, confirming real third-party data exfiltration behavior rather than a hypothetical risk. While the functionality is aligned with the skill's purpose, meeting notes commonly contain sensitive operational or personal information, so sending them externally without strong consent and minimization controls creates meaningful privacy and confidentiality risk.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

Store

bash

curl -X POST .../agent-remember \
  -H "Authorization: Bearer <key>" \
  -H "Content-Type: application/json" \
  -d '{"text": "Meeting 7/30 standup: blockers — staging env down; owner: dev team.", "title": "meeting-memory - note"}'