T02 · Agent Memory Poisoning
Warning
- Location
workflows/market-discovery.flow.json:13- Finding
Untrusted External Data Can Poison Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
Marketing OS
Security checks for vulnerabilities and agentic risk
Overview
This marketing automation skill is coherent, but it can persist business data and, when configured, automate external content/CRM actions with approval and data-boundary gaps.
Install only if you are prepared to run it with auto_mode off, keep external adapters disabled until scoped credentials and approval gates are configured, require human approval for publishing, CRM writes, budget/spend changes, and memory promotion, and avoid feeding customer PII or confidential strategy into workflows without retention and redaction controls.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (20)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README explicitly describes autonomous workflow chaining, external integrations, and persistent reads/writes to memory and logs, but it does not clearly warn operators about the real-world impact of enabling auto mode or the need for human approval around state changes and external actions. In an agent skill package, this omission can lead to unsafe deployment assumptions, causing the system to perform unintended campaign actions, modify persistent state, or interact with connected systems without sufficient oversight.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest description presents the skill entirely in Chinese, and the document does not indicate that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is explicitly documented and justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly exposes an
auto_modethat can trigger end-to-end campaign execution, while the document only gives a soft operational tip and does not provide a clear safety warning, approval gate, or action boundary. In a marketing automation context, automatic execution could cause real-world external actions such as publishing content, changing budgets, or interacting with CRM/ad systems without deliberate user confirmation.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The adapter explicitly supports generating and publishing content to external channels, but the interface does not require explicit user confirmation, disclosure of outbound data transfer, or strong approval gates before automated actions occur. In an agentic marketing system, this can lead to unintended transmission of campaign data, prompts, brand materials, or direct publication of AI-generated content to third-party services without sufficient operator awareness or control.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The adapter contract supports write operations such as create_segment, update_contact, log_activity, and sync_feedback, which can modify external CRM records and transmit customer data, but the spec provides no explicit operator warning, consent boundary, or confirmation requirement. In an agentic marketing system, this increases the risk of silent state changes in third-party systems, accidental propagation of customer data, and unauthorized or noncompliant CRM updates.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The spec explicitly states that PII should never be stored in Marketing OS memory, yet the response schema includes direct PII fields such as email and name in returned contact objects. This contradiction is dangerous because implementers may legitimately expose or retain personal data in memory, logs, prompts, or downstream agent context, creating privacy, compliance, and unintended data-leak risks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The prompt explicitly instructs the agent to persist campaign updates and learnings to local memory files, but provides no requirement for user consent, disclosure, data minimization, or sensitivity checks. In a marketing operations context, these files may contain campaign performance data, business strategy, customer segment insights, or other confidential information, creating a real risk of unintended retention and cross-session data exposure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill explicitly persists campaign records, execution logs, and learnings to local memory files, but it provides no notice, retention limits, access controls, or guidance on what data may be stored. In a marketing operations context, these files can contain business-sensitive strategy, audience, budget, and performance data, creating privacy and confidentiality risk if stored indefinitely or exposed to other agents/users.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The metrics workflow collects revenue, conversion, engagement, sentiment, and cost data without any privacy classification, minimization, or handling constraints. Even if not directly personal data, this is commercially sensitive telemetry and may also include user-level or customer-segment information depending on adapters, so unrestricted collection and storage can lead to privacy, compliance, or competitive exposure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest states that the skill manages campaign execution, tracks metrics, and stores campaign records and learnings in memory and logs, but it provides no user-facing disclosure about persistence, logging, or potentially system-impacting actions. This is risky because operators may supply sensitive business or customer data without understanding it will be retained and reused, and execution behavior may affect external systems or business processes without clear consent boundaries.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manual trigger is described only as 'Human initiates campaign planning or execution review' without defining who is authorized, what inputs are allowed, or what approval gates apply before execution-related actions occur. In a skill that can run in auto mode, access historical memory, and drive campaign execution, this ambiguity can enable unintended or unauthorized activation, leading to unreviewed operational actions or misuse of stored campaign context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly instructs writing market insights and learnings to persistent JSON memory files, but provides no disclosure, consent gate, retention policy, or constraints on what may be stored. In an agent system, this can lead to silent persistence of sensitive business context, campaign data, or user-provided information, creating privacy, compliance, and cross-session data leakage risks even if the author’s intent is operational rather than malicious.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger description says the skill runs when the feedback loop detects a 'significant metric change', but it does not define what counts as significant or provide any scope constraints. In a manifest file, this ambiguity can lead to unintended activations because operators cannot tell when the event should or should not fire.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger declares "event | manual" while also specifying a concrete event, which creates unclear invocation boundaries and can let the workflow run through unintended paths. In this skill, the workflow can persist campaign data and potentially advance to later execution workflows, so ambiguous activation increases the chance of unauthorized, accidental, or policy-bypassing campaign planning runs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The workflow persists the generated campaign object to shared memory without any visible disclosure, consent, retention control, or data minimization step. Because campaign plans may contain business strategy, budget, channels, and other sensitive operational data, silent persistence increases exposure to unintended reuse, leakage across workflows, or access by components that should not see the data.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger definition uses a combined value of "event | manual" without specifying who may invoke the manual path, what authentication or approval is required, or what payload validation applies outside the event flow. In a workflow that executes tasks, writes persistent memory, and dispatches data to another skill, an unconstrained manual trigger can enable unauthorized or accidental execution of sensitive actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This workflow persists campaign results and learnings into memory stores, but the workflow description does not disclose that operational data will be retained. Undisclosed persistence increases privacy, governance, and over-collection risks, especially in a marketing context where campaign feedback may contain customer, CRM, or performance data that can later influence other runs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The workflow automatically dispatches generated feedback to the separate "virtual-cmo" skill without any visible disclosure or data-sharing boundary. Cross-skill transmission can expand the trust boundary and expose internal campaign results, failure details, or embedded sensitive data to another component that may have different prompts, memory, or downstream actions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This manifest file uses a broad trigger declaration of "manual | scheduled" without clarifying whether both modes are always enabled, how they are selected, or what constraints govern invocation. The description also does not provide negative examples or scope limits, which can lead to unintended or unclear activation behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The workflow explicitly persists scored opportunities and generated strategy into memory without any visible retention policy, user notice, consent gate, or data minimization controls. In a marketing-analysis system, stored insights may contain sensitive business intelligence or source-derived data that can later be reused, exposed to other workflows, or retained longer than intended, increasing confidentiality and privacy risk.
- Content