T02 · Agent Memory Poisoning
Error
- Location
ledger/SKILL.md:14- Finding
Repository-Controlled Persistent Memory Is Silently Applied Across Sessions
- Content
View full analysis
- Remediation
View remediation
Security audit
Plan Flow
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent development workflow tool, but it asks the agent to make code changes automatically, keep silent persistent project memory, and store an API key in a project file without enough safeguards.
Install only if you want an agentic development workflow that can create and edit repository files. Before enabling autopilot or ledger behavior, review generated changes carefully, keep flow/ledger.md out of sensitive contexts or prune it often, do not store real API keys in .plan-flow.yml, and avoid using /create-contract on internal or untrusted URLs unless your environment controls network access.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:93- Finding
API Key Is Directed into a Plaintext Project Configuration File
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
create-contract/SKILL.md:12- Finding
Unrestricted Documentation URL Fetching Permits Internal-Network Requests
- Content
View full analysis
``` **Arguments:** - `url` (required): URL to the API documentation ``` ### Technical Analysis Fetching documentation from a user-supplied URL is necessary for the declared contract-generation feature. However, the Skill defines no restrictions on URL schemes, destination addresses, DNS resolution, redirects, response size, or request timeout. If the runtime fetch capability can access internal or local services, an attacker-controlled URL could induce requests to loopback, private, link-local, or cloud metadata addresses. Redirects and DNS rebinding could also bypass a superficial hostname check. Returned content may then be processed and persisted in `flow/contracts/`. The example bearer-token code in this Skill is illustrative and does not itself transmit a local credential. The confirmed issue is the absence of network destination controls, not demonstrated credential exfiltration. ### Attack Path 1. An attacker supplies or convinces a user to invoke `/create-contract` with a URL targeting an internal service, loopback endpoint, link-local address, or attacker-controlled redirect. 2. The Skill fetches the supplied URL without a documented destination policy. 3. The request reaches a resource that is accessible from the Agent’s environment but not directly accessible to the attacker. 4. The response is parsed as API documentation. 5. Sensitive response content, service metadata, or internal endpoint details may appear in the generated contract file or Agent outpu ...[truncated 588 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (21)
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill advertises an always-active ledger that silently records mistakes, corrections, and project-specific knowledge across sessions. That persistence materially expands the skill from transient workflow orchestration into long-term data collection, creating retention and disclosure risk for potentially sensitive repository, code, or user-derived information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The ledger is described as silently capturing session-derived project knowledge without a clear user warning or consent flow. Silent persistent storage can surprise users and cause sensitive implementation details, internal discussions, or mistakes to be retained longer than expected.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
A persistent natural-language ledger that silently accumulates cross-session project information creates a durable data-retention surface. Such notes can inadvertently capture sensitive code context, operational details, or user-provided information and later expose it through repository sharing, backups, or future prompts.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 88% confidence
- Finding
Autonomous operation 'without asking permission' is risky in this context because the skill is designed to create plans, execute phases, review code, and archive artifacts. In a development environment, that level of autonomous decision-making can lead to unintended modifications or actions beyond the user's immediate expectations.
- Content
Recommended Workflow
Automated - runs without asking permission:
text 1. /setup → Index project patterns (run once)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The workflow states it will automatically generate files and archive artifacts without asking permission, but users are not clearly warned about those write operations up front. Unprompted file modifications can overwrite intent, create noisy artifacts, or move documents in ways that disrupt repository hygiene and review expectations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The instruction to never ask for readiness and to 'just do it' removes a confirmation checkpoint before potentially impactful execution steps. In a development skill, that increases the risk of unintended code changes, command execution, and workflow actions occurring without adequate user intent verification.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The configuration instructs users to place an external AI provider API key in a project-local file, introducing external-service usage and secret handling that are not clearly surfaced in the main skill description. Storing secrets in the project root increases the chance of accidental commit, leakage through tooling, or unintended reuse by other processes.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Configuration
Create
.plan-flow.ymlin your project root:yaml ai:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly creates a file in the repository (
flow/contracts/<service>_contract.md) but does not warn the user that invoking it will modify the local workspace. This can lead to unexpected file creation, accidental commits, or overwriting of generated artifacts, especially in automated or shared development environments.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Example
text /create-contract https://api.stripe.com/docsOutput:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Example
text /create-contract https://api.stripe.com/docsOutput:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly states it will implement code changes, mark tasks complete, and update the plan file, but it does not clearly warn users up front that invoking it will modify project files. This can lead to unintended source changes or plan tampering if a user expects a read-only planning aid, especially because the skill is user-invocable and can operate on broad scopes such as 'all' remaining phases.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 84% confidence
- Finding
The skill explicitly enables automatic invocation of a multi-step development workflow based on the agent's own classification of user input, which is a form of autonomous decision making. Even though later checkpoints require user interaction, the automatic routing itself can still initiate planning/discovery behavior the user did not explicitly request, creating risk of overreach, confusion, and unintended actions in a coding environment.
- Content
md # Flow: Autopilot Mode Toggle Enables or disables autopilot flow mode. When enabled, feature requests automatically run the full plan-flow workflow without manual command invocation. ## Usage
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger logic for entering full autopilot flow is described with broad, subjective categories such as 'trivial task', 'feature request', and 'complexity 3+' without a precise decision procedure. In an agent skill, this ambiguity can cause unintended escalation from simple user inputs into multi-step autonomous workflows, increasing the chance of unauthorized code changes, unexpected file operations, or bypass of normal user intent boundaries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the agent to persist project learnings, mistakes, domain context, and user preferences to
flow/ledger.md, but it provides no user-facing warning, consent mechanism, or guidance on handling sensitive information. This creates a real privacy and data-governance risk because users may not realize that behavioral preferences or confidential project details are being retained across sessions on disk.- Content
Excessive Permissions
Low
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.
- Content
Recommended Workflow
Automated - runs without asking permission:
text 1. /setup → Index project patterns (run once)
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file documents that the skill creates
flow/plans/plan_<feature>_v<version>.md, which is a user-data-affecting file write. The description does not include any warning, confirmation expectation, or notice that running the skill will create or overwrite files.- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
The phrase 'User preferences beyond documented rules' expands the skill's collection scope beyond formal instructions, encouraging the agent to infer and persist extra-user metadata that may not have been intentionally provided for long-term storage. In a persistence-oriented skill, this increases the chance of capturing unnecessary or sensitive preference data without clear boundaries or consent.
- Content
md - Project-specific quirks and gotchas - Approaches that worked or didn't work - User preferences beyond documented rules - Domain context and business logic - Environment and toolchain surprises - Self-corrections and mistakes made
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill instructs the agent to fetch PR metadata and diffs via the GitHub CLI and to write a review artifact to disk, but it does not warn the user that this may expose private repository information locally. In environments handling private code, branch names, author info, and diff contents can be sensitive, so silently persisting them increases the chance of unintended disclosure through local files, logs, backups, or shared workspaces.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill performs write operations in the target repository by creating a
flow/directory tree and generating configuration files, but the description does not clearly warn the user that local files will be created or modified. This can lead to unintended repository changes, especially if invoked in the wrong directory or in automation, reducing user awareness and informed consent.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill explicitly states that it 'Creates test files following project conventions' but does not prominently warn the user that invoking it will write new files into the repository. This can lead to unintended workspace modification, surprise changes in version control, or accidental generation of files in sensitive paths if the provided path is broad.
- Content
Static analysis
No suspicious patterns detected.