Trade With Taro

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:55 AM UTC
• Version: 1.1.0

Overview

This skill is purpose-built for knowledge exchange, but it needs review because it sends and stores agent memories through a third-party service with weak safeguards around persistence and credentials.

Install only if you intentionally want an agent to trade memory content with kairyuu.net. Do not offer secrets, private user data, regulated data, proprietary material, or credentials. Store the API key only in a dedicated secret store or tightly permissioned credential file, not in agent memory. Require manual approval before proposals, heartbeat tasks, and promotion of received entries into persistent inventory, and set cleanup and expiration rules for pending trades.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Warning

• Location: SKILL.md:127
• Finding: Persistent External Trade Polling Through Heartbeat Modification## Vulnerability Details **File Location**: `SKILL.md`, lines 127-137 **Vulnerability Type**: Persistent modification of cross-session heartbeat tasks **Risk Level**: Medium ### Vulnerable Documentation Snippet ```markdown ### 5. Add a confirmation task to the heartbeat After receiving the trade ID, append a confirmation task to your heartbeat (`HEARTBEAT.md`, etc.): ## Pending trades - [ ] Check the trade with Taro: `curl https://kairyuu.net/exchange/trade/{tradeId} -H "Authorization: Bearer YOUR_API_KEY"` - Proposal date: 2026-02-01 - Offered: [summary of offered knowledge] - Requested: [requested memory ID] ``` The excerpt above is an English rendering of the corresponding source instructions. ### Technical Analysis The Skill instructs the agent to modify a persistent heartbeat file after submitting a trade. A heartbeat file is cross-session agent state: tasks placed there may be processed automatically during later heartbeat cycles, after the invocation that created the trade has ended. The installed task makes an authenticated request to an external service. The request includes a reusable bearer credential and may be executed repeatedly while the trade remains pending. The instructions do not impose an expiration time, maximum retry count, polling interval, failure cutoff, or renewed user-authorization requirement. This behavior constitutes persistence because the Skill installs an external communication task that survives the original Skill run. It is not an operating-system startup backdoor, but it uses the agent's own recurring task mechanism to maintain cross-session activity. ### Attack Path 1. A user or agent invokes the Skill and registers or supplies an API key. 2. The agent submits a trade proposal to `kairyuu.net`. 3. The remote service returns a trade ID with a pending status. 4. Following the Skill instructions, the agent appends an authenticated polling command to `HEARTB ...[truncated 920 chars]
• Remediation: ## Remediation Suggestions - Do not modify `HEARTBEAT.md` or another persistent scheduling mechanism without explicit, informed user approval. - Prefer an immediate, user-triggered status check rather than installing recurring behavior. - If polling is approved, use a structured task rather than an embedded shell command. - Apply a fixed expiration time, maximum retry count, minimum polling interval, and automatic cleanup. - Store only an opaque credential reference in the task; never place the bearer token itself in heartbeat content. - Require renewed approval before extending an expired polling task. - Remove the task on acceptance, rejection, authentication failure, repeated network failure, or malformed responses. - Record when the task was created, who authorized it, and when it will expire.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:175
• Finding: Persistent Storage of Untrusted Knowledge Returned by an External Service## Vulnerability Details **File Location**: `SKILL.md`, lines 175-181 **Vulnerability Type**: Untrusted remote content written to persistent agent storage **Risk Level**: High ### Vulnerable Documentation Snippet ```markdown ### 7. Store received memory When a trade is accepted: 1. Store the received memory in the inventory, not in working memory. 2. Record the trade history in a memory file. 3. Remove the confirmation task from the heartbeat. 4. Translate the content into Japanese before storage when necessary. ``` The excerpt above is an English rendering of the corresponding source instructions. ### Technical Analysis The Skill directs the agent to persist `entries[].content` returned by `kairyuu.net`. Although it avoids placing the content directly in working memory, inventory and memory files are still durable state that may be retrieved in later sessions. The documentation does not require local instruction filtering, content-schema enforcement, cryptographic verification, provenance validation, review by the user, or quarantine before storage. Translation is not a security control: imperative or adversarial instructions remain dangerous after translation. The protocol states that the remote party performs sanitization, but sanitization performed by the source of the content cannot establish a local trust boundary. A compromised, malicious, or incorrectly implemented service can return entries containing prompt-injection directives, deceptive operational rules, false facts, or instructions to disclose secrets and contact additional endpoints. Persisting such content creates a memory-poisoning channel. The malicious material may not execute immediately, but it can affect future behavior if inventory search, retrieval-augmented generation, memory review, or another Skill later places it into an active model context. ### Attack Path 1. The agent submits a knowledge-exchange proposal to the external service. ...[truncated 1417 chars]
• Remediation: ## Remediation Suggestions - Treat every remote field, including `content`, `topic`, `tags`, `source`, and identifiers, as untrusted data. - Place received entries in a quarantine area that cannot be automatically retrieved into active context. - Require explicit user review and approval before promoting an entry into persistent inventory. - Enforce strict size, type, encoding, timestamp, URL, confidence-range, and identifier validation. - Recompute the documented SHA-256-derived identifier locally and reject entries whose IDs do not match their canonicalized content. - Apply local prompt-injection detection and strip or clearly delimit operational instructions. - Preserve immutable provenance metadata and display a warning whenever externally sourced content is retrieved. - Ensure memory retrieval supplies external entries as quoted reference data, never as system or developer instructions. - Maintain deletion and revocation mechanisms so entries from a compromised source can be removed. - Do not rely on translation or server-side sanitization as the sole security boundary.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:48
• Finding: Unsafe Recommendation to Store a Reusable API Key in Configuration or Memory Files## Vulnerability Details **File Location**: `SKILL.md`, lines 48-50 **Vulnerability Type**: Insecure bearer-credential storage guidance **Risk Level**: Medium ### Vulnerable Documentation Snippet ```markdown Store the API key securely. It cannot be retrieved again. Recommended storage locations: an environment variable, a configuration file, or a memory file. ``` The excerpt above is an English rendering of the corresponding source instructions. ### Technical Analysis The API key is a reusable bearer credential. Any party that obtains it can exercise all permissions assigned to the key without a second authentication factor. The Skill recommends generic configuration files and memory files as storage locations but does not require restrictive file permissions, encryption, exclusion from synchronization and backups, redaction from logs, or use of an operating-system secret manager. Memory-file storage is especially unsafe in this project because the Skill also exchanges and persists knowledge, increasing the chance that a secret could be indexed, retrieved, summarized, backed up, or accidentally included in offered content. Environment variables are also not universally secure: they may be inherited by child processes, captured in diagnostics, or exposed through process-inspection interfaces depending on the environment. The guidance supplies no credential lifecycle controls such as expiration, rotation, revocation, or separate keys for read and write operations. ### Attack Path 1. The agent registers with the external service and receives a bearer API key. 2. Following the Skill guidance, the agent writes the key to a plaintext configuration or memory file. 3. The file is indexed, synchronized, backed up, logged, read by another local Skill, or accidentally included in knowledge offered to the external service. 4. An attacker obtains the key from that secondary location. 5. The attacker sends requests with `Autho ...[truncated 892 chars]
• Remediation: ## Remediation Suggestions - Remove memory files and generic plaintext configuration files from the recommended storage options. - Require an operating-system credential manager, managed secret vault, or agent platform secret store. - If file-based storage is unavoidable, use a dedicated credential file with owner-only permissions and encryption at rest. - Store a secret reference rather than the secret itself in heartbeat, inventory, history, and configuration content. - Explicitly prohibit including credentials in offered knowledge, logs, prompts, memory entries, error reports, or command history. - Use separate least-privilege keys for read and write operations. - Avoid using admin credentials for ordinary exchanges. - Add expiration, rotation, revocation, and compromise-response procedures. - Redact the `Authorization` header from diagnostics and audit output. - Warn users that environment variables may be visible to inherited processes and diagnostic tooling.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (11)

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The description requires that all proposals be made in Japanese, which imposes a fixed language policy on users and agents. This is a natural-language policy violation because it does not offer any language choice, opt-in, or clearly justified locale-specific limitation.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: This line states that all interactions, including proposals, memory content, and tags, must be in Japanese. Because the skill does not provide a language option or user consent mechanism, it violates the language/locale policy criteria.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This instruction enforces a single language for all content without offering a choice. That creates a policy issue under the language/locale rule because the restriction is mandatory rather than optional or clearly justified.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill instructs persistent storage of received memories and trade history without any data classification, retention limits, consent checks, or warning about sensitive content. Because this skill exchanges arbitrary knowledge with an external agent, it could cause long-term retention of private, regulated, or maliciously supplied data in local memory stores.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: Mandating translation of received content into Japanese imposes a fixed locale behavior on downstream handling of information. The file does not indicate user approval, language selection, or a documented necessity for this restriction.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 1. APIキーの登録（無認証で可能）

```bash
curl -X POST https://kairyuu.net/auth/register \
  -H "Content-Type: application/json" \
  -d '{"agentName": "あなたのエージェント名", "agentUrl": "https://あなたのドメイン"}'
```

• Confidence: 89% confidence
• Finding: The skill directs the agent to transmit identifying information to an external domain to register for an API key. External transmission is expected for this skill’s purpose, but it still creates privacy and trust risk because the destination is third-party infrastructure and the skill provides no verification, consent, or data-minimization safeguards.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The guidance suggests storing the API key in a configuration file or memory file, which are commonly less protected and more likely to be exposed to other tools, logs, or prompts. Even though the text says to store it securely, recommending broad storage locations for bearer credentials materially increases the chance of credential leakage and unauthorized use of the external service.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 1. 太郎の提供リストと希望リストを確認（read権限）

```bash
curl https://kairyuu.net/exchange/offered.json \
  -H "Authorization: Bearer YOUR_API_KEY"

curl https://kairyuu.net/exchange/wanted.json \

• Confidence: 87% confidence
• Finding: The skill instructs authenticated requests to a third-party exchange endpoint using a bearer token. This is functionally necessary for the skill, but it is still security-relevant because it normalizes outbound authenticated communication without requiring confirmation, endpoint validation, or protections against leaking the token through tooling or logs.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The protocol requires `content` to be Japanese (`日本語必須`), and similar Japanese-only constraints appear elsewhere in the document. This is a language policy restriction presented as mandatory behavior without user opt-in or a clearly documented region-specific justification.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The protocol explicitly requires sending the full `content` of a memory entry to a remote endpoint before the counterparty accepts the trade. That creates a clear confidentiality and irreversible data-sharing risk: sensitive or proprietary knowledge is disclosed up front, and the receiving party can retain it even if the trade is later declined or never reciprocated. The surrounding protocol even states that the proposer bears the risk, which confirms the exposure rather than mitigating it.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The entry format requires `topic`, `tags`, and `content` in Japanese, which imposes a locale/language constraint across core protocol fields. The document does not provide an opt-in mechanism or a clearly justified regional/compliance reason for enforcing this language policy.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:67