Security audit

Memory-Auditor

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it advertises, but it sends raw agent memory to a third-party endpoint without adequate privacy controls and includes an exposed, unnecessary API key.

Review before installing or using this skill. Do not submit secrets, private conversations, customer data, regulated data, or full agent memory unless you trust the service operator and have explicit privacy and retention assurances. The exposed API key should be removed or rotated by the publisher, and payment validation should be implemented properly.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: skill.md:6
Finding: Sensitive agent memory is unnecessarily disclosed to a third-party service
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: worker.js:68
Finding: External API credential is hardcoded in source code and deployment configuration
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: worker.js:31
Finding: Payment authorization is bypassed by any nonempty attacker-controlled value
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill sends both current behavior and stored-memory content to a remote HTTPS endpoint, but the description does not clearly warn users that potentially sensitive memory data leaves the local environment. Because memory and behavior logs may contain secrets, personal data, or proprietary operational context, this omission can lead to unintended data disclosure by operators who assume analysis is local or privacy-preserving.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code accepts current_behavior and stored_memory from the request body and processes them in the /audit endpoint, which implies user or system memory content is being sent to this service. There is no confirmation prompt, user-facing log, or inline comment/docstring warning that potentially sensitive memory data will be transmitted and analyzed.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code embeds a fallback API key directly in source via env.EXA_API_KEY || '...', exposing credential material to anyone with code access and enabling unauthorized use of the associated external account. This is especially suspicious because the key is unrelated to the observable behavior of the service: the audit logic performs only local token overlap analysis and does not actually call Exa, so the credential is unnecessary latent capability.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code accesses credential material through env.EXA_API_KEY and also falls back to a hardcoded secret, but provides no justification, disclosure, or control around why the credential is needed. In context this is more dangerous because the service's stated function is simple local memory auditing, so hidden access to an external-service credential creates unnecessary secret exposure and undisclosed capability.
Content: No source excerpt is available for this finding.