📡 Knowledge & Trends Engine

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:27 AM UTC
• Version: 1.0.0

Overview

This skill is not clearly malicious, but it should be reviewed because it can read prior memory, fetch user-provided content, and persist summaries on a schedule without tight consent or sensitivity controls.

Install only if you are comfortable with the skill building long-term memory from prior conversations and shared content. Before using scheduled review or content parsing, confirm that your environment scopes memory per user, blocks unsafe internal URL fetches, and offers a way to preview, redact, disable, or delete saved summaries.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:38
• Finding: Overly Broad Cross-Session Memory Access and Persistent Retention<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 38–40 and 74–76 **Vulnerability Type**: Excessive access to shared memory and potentially sensitive historical records **Risk Level**: Medium ### Vulnerable Code ```markdown - Read `memory/tier1-public/` for all skill stats and public knowledge entries - Read `memory/concepts/` for concept files stored from previous sessions - Read recent daily notes: `memory/YYYY-MM-DD.md` (last 7 days) ``` ```markdown Use `complex-memory-manager` to store the summary: - T1: `memory/tier1-public/concepts-summary-YYYY-MM.md` (concept names, relationships, categories) - T2: `memory/tier2-internal/concepts-detail-YYYY-MM.md` (detailed notes, sources, encrypted if personal) ``` ### Technical Analysis The workflow directs the Agent to read entire shared-memory directories and seven days of daily notes without first limiting access to the current user, conversation, or requested topic. Daily notes and concept records may contain information unrelated to the immediate request, including personal or confidential context from previous interactions. The collected information is subsequently summarized and written to persistent Tier 1 and Tier 2 records. This creates a secondary copy of historical data and may cause private details to be retained or surfaced outside their original context. The instruction states that personal Tier 2 content should be encrypted, but the actual storage and encryption behavior is delegated to the external `complex-memory-manager` Skill. That dependency was not included in the audited project, so its access controls and encryption guarantees could not be verified. ### Attack Path 1. A user or other requester invokes the concept-summarization workflow. 2. The Agent reads all entries in `memory/tier1-public/`, `memory/concepts/`, and the previous seven days of daily notes. 3. The broad scan encounters information unrelated to the request or belonging to a different conversational ...[truncated 1038 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit user consent before reading daily notes or records from previous sessions. 2. Restrict memory reads by authenticated user, conversation identifier, requested date range, and topic. 3. Retrieve only relevant indexed records instead of scanning complete directories. 4. Treat daily notes and Tier 2 records as private by default and exclude them from public summaries. 5. Present a preview of extracted concepts and proposed storage destinations before persistence. 6. Apply data-minimization rules that remove credentials, personal identifiers, financial information, and unrelated private content. 7. Enforce authorization checks in the storage layer rather than relying only on natural-language Skill instructions. 8. Define retention periods and provide deletion mechanisms that remove both source records and derived summaries. 9. Pin and independently audit `complex-memory-manager`; verify that Tier 2 encryption is authenticated, uses securely managed keys, and is enforced rather than optional. 10. Record privacy-preserving audit logs identifying which records were read and written without recording their sensitive contents. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:79
• Finding: Unrestricted Fetching of User-Controlled URLs<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 79–83 **Vulnerability Type**: Server-Side Request Forgery risk through insufficient URL validation requirements **Risk Level**: Medium ### Vulnerable Code ```markdown ### Workflow 2: Parse External Content (On-demand) User shares content: "watch this video", "read this article", "analyze this image", "这个概念你记住" **Step 1: Content Analysis** - For **articles** (`web_fetch` URL): extract key concepts, arguments, data points ``` ### Technical Analysis The Skill directs the Agent to pass user-provided article URLs to `web_fetch`, but it does not require validation of URL schemes, resolved IP addresses, destination ports, redirects, or network boundaries. If `web_fetch` does not independently enforce equivalent protections, an attacker may submit a URL targeting localhost, private-network services, link-local addresses, or cloud instance metadata endpoints. Redirects and DNS rebinding could also bypass validation performed only on the initial URL. Fetched content is processed into concepts and may be stored persistently, increasing the possibility that data obtained from an internal endpoint is returned to the requester or copied into memory. The project does not contain the implementation of `web_fetch`, so actual exploitability depends on the protections provided by the hosting environment. ### Attack Path 1. An attacker asks the Skill to analyze an attacker-controlled URL. 2. The URL directly references an internal destination or redirects to localhost, a private address, a link-local endpoint, or a cloud metadata service. 3. Workflow 2 invokes `web_fetch` without a documented destination-validation step. 4. If the fetch tool permits the request, it connects from the Agent's network context to the restricted endpoint. 5. The response is supplied to the model for analysis. 6. Internal response data may be included in the analysis, returned to the attacker, or written into persistent co ...[truncated 942 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Permit only explicitly supported `http` and `https` URLs. 2. Reject embedded credentials, malformed hosts, unsupported ports, and ambiguous or noncanonical IP representations. 3. Resolve the hostname before connecting and block loopback, private, link-local, multicast, reserved, and cloud metadata address ranges for both IPv4 and IPv6. 4. Repeat DNS and destination validation for every connection and every redirect. 5. Disable redirects by default or impose a small redirect limit with validation at each hop. 6. Protect against DNS rebinding by binding validation and connection to the same resolved destination. 7. Apply a domain allowlist when practical, especially for automated or scheduled workflows. 8. Require confirmation before fetching URLs from unknown or untrusted domains. 9. Enforce strict response-size, download-time, content-type, and decompression limits. 10. Run the fetcher in an isolated network environment without access to internal services or cloud metadata. 11. Treat fetched documents as untrusted data and prevent their contents from altering Agent instructions. 12. Avoid persisting fetched content until the destination and resulting data have passed validation and sensitivity checks. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The top-level description authorizes periodic summarization of user interactions and parsing of user-shared media, then ties that to memory accumulation and self-iteration. Because no data minimization, sensitivity filtering, or consent boundaries are defined, the skill can capture personal or confidential information and persist it beyond the user's expectation.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly includes periodic scheduled reviews and a cron-driven self-review path, but it does not define strong gating around when autonomous review and storage are allowed. That can cause the agent to process prior conversations and external-content-derived concepts without a fresh, specific user request, increasing the chance of unintended collection and persistence of sensitive information.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill description and workflows state that conversation-derived concepts and parsed article/video/image content will be stored into memory files, including public-tier artifacts, but there is no prominent warning or consent mechanism. Users may share content assuming transient analysis, while the skill silently converts it into retained memory, creating privacy and compliance risk.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: This workflow instructs the agent to scan recent notes and concept files, extract concepts from prior conversations, and store results in `memory/tier1-public/` summaries. That creates a direct path for user-derived information to be propagated into broadly readable or less-protected artifacts, amplifying exposure if sensitive details were discussed in earlier sessions.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill tells the agent to 'remember' user explanations and store them as structured concept notes, including source metadata, summaries, and related concepts. Without safeguards, a user may provide proprietary, personal, or otherwise sensitive information that gets retained and cross-linked indefinitely, making later disclosure or misuse more likely.

Static analysis

No suspicious patterns detected.