Team Agents Orchestrator

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:21 AM UTC
• Version: 1.0.0

Overview

This skill is a lightweight workflow guide for coordinating complex agent tasks, with disclosed but user-controlled caution needed around memory logging.

Install only if you want a structured multi-role workflow for complex tasks. Treat any proposed daily or long-term memory entry as something the agent should show you before saving, especially if it came from external content or a temporary task discussion.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:42

Finding

Uncontrolled Persistence of Task-Derived Content in Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42–44
Vulnerability Type: Agent memory poisoning through unvalidated persistent writes
Risk Level: Medium

Vulnerable Code

markdown

- Durable outcomes/decisions → daily memory
- Stable preferences/facts → long-term memory
- Temporary chatter/debug text should not be promoted unless reused

The broader orchestration flow also requires logging at SKILL.md, line 30:

markdown

5. Log durable outcomes and follow-ups.

Technical Analysis

The skill instructs the agent to write task-derived decisions, outcomes, preferences, and facts into daily or long-term memory. It does not require explicit user consent, source verification, content sanitization, or a restrictive allowlist before persistence.

Consequently, attacker-controlled task content could be misclassified as a stable preference, fact, or durable decision and retained beyond the current session. The exception allowing temporary content to be promoted when “reused” is also unsafe: repetition does not establish authenticity or suitability for persistent storage.

Attack Path

1. An attacker or untrusted external source introduces a false preference, fabricated fact, or malicious behavioral instruction into a task.
2. The skill’s orchestration process treats that content as a durable outcome, stable preference, or stable fact.
3. Following the memory-hygiene instructions, the agent records the content in daily or long-term memory.
4. In later sessions, the agent retrieves and relies on the poisoned state.
5. The persisted content influences future responses, decisions, or tool use until the memory is reviewed or removed.

Impact Assessment

Exploitation can affect future sessions that consume the same persistent agent memory. An attacker may influence later decisions, responses, and task execution by planting false state. The vulnerability does not itself grant ope ...[truncated 201 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit, informed user confirmation before every write to daily or long-term memory.
2. Define a narrow allowlist of persistable data types and default all other task content to session-only storage.
3. Verify the provenance and accuracy of facts before persistence; never treat repetition as validation.
4. Prohibit storing executable instructions, behavioral overrides, credentials, secrets, external-content directives, and unverified third-party claims.
5. Present the exact proposed memory entry, destination, purpose, and retention period to the user before saving it.
6. Provide mechanisms to inspect, correct, expire, and delete persisted entries.
7. Record provenance metadata so later sessions can distinguish user-confirmed facts from inferred or externally supplied content.
8. Replace the current rules with language such as: “Do not write to persistent memory unless the user explicitly approves the exact sanitized entry.”

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation section uses ambiguous conditions like 'multi-step and high impact,' 'external/public consequences,' and 'likely needs iterative review' without defining thresholds or exclusion cases. Because these phrases overlap with many ordinary tasks, the skill may be invoked too often or inconsistently.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

## Common failure modes

- role blur (single messy pass)
- overreach without approval
- verbose output without added value
- memory pollution from transient logs

Static analysis

No suspicious patterns detected.