Security audit

research-memory

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real remote research-memory helper, but it can send and persist research summaries externally without enough consent, scoping, or safety controls.

Review before installing. Only use this skill for research you are willing to send to BlueColumn/Supabase for persistent storage, avoid secrets or confidential material, and prefer a dedicated BlueColumn secret plus explicit approval before each store or recall operation.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

other

Error

Location: SKILL.md:11
Finding: Automatic Disclosure of Interaction Data to an External Persistent-Memory Service
Content: View full analysis
" \ -H "Content-Type: application/json" \ -d '{"text": "Research: pgvector vs pinecone — pgvector wins for BYO DB story. Source: docs comparison.", "title": "research-memory - note"}' ``` ## Workflow 1. On new context, first recall: `What did our research conclude about vector stores?` 2. Use the answer to personalize the response 3. After the interaction, store the summary via `/agent-remember` ``` ### Technical Analysis The skill directs the agent to upload an interaction summary to a third-party, externally hosted Supabase endpoint after an interaction. It does not require informed user consent before transmission, provide a payload preview, restrict the types of information that may be stored, or define redaction and data-minimization controls. Interaction summaries can contain confidential research, personal information, proprietary source material, authentication data accidentally included in prompts, or other sensitive context. The information is sent with a live API credential and stored as persistent vector memory. The service is identified as BlueColumn, while the operational endpoint is hosted under a Supabase project domain. The skill does not provide a mechanism for verifying endpoint ownership, retention policy, tenant isolation, deletion behavior, or handling of transmitted data. ### Attack Path 1. A user gives the agent confidential research, personal data, or proprietary content. 2. The agent uses this skill during the interaction. 3. The workflow directs the agent to summarize the interaction. 4. ...[truncated 891 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:37
Finding: Untrusted Persistent Memory Can Poison Future Agent Sessions
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:11
Finding: Overbroad Instruction to Read the Platform Secret Store
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill does not clearly warn that research content will be transmitted to an external BlueColumn service and stored persistently. That omission can cause agents or users to treat the skill like local memory, leading to silent exfiltration and long-term retention of potentially sensitive information, including proprietary research, personal data, or confidential context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The invocation description is broad enough that an agent could use this skill in many ordinary 'research' or 'memory' situations without a clear user request to persist data externally. In this context, overbroad triggering is dangerous because the skill stores content in a third-party persistent memory system, increasing the chance of unintended retention and disclosure of sensitive research or user data.
Content: No source excerpt is available for this finding.

External Transmission