Agent Shared Context

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:52 PM UTC
• Version: 1.0.0

Overview

The skill is transparent about sharing local files between agents, but it creates a persistent channel where one agent can influence what other agents do later without provenance or trust controls.

Install only in agent groups where all writers are trusted or where you can tolerate shared context influencing later actions. Treat trends, titles, URLs, and summaries as untrusted data, avoid letting shared context alone authorize public posting or sensitive actions, and consider adding per-agent write paths, provenance, length limits, and audit/approval controls before using it in cron-driven workflows.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: scripts/shared-context.py:23

Finding

Persistent Cross-Agent Context Poisoning Through Untrusted Shared Content

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill explicitly instructs agents to read from and write to shared files, but it declares no tool scope or permission boundaries. In a multi-agent environment, undeclared file capabilities increase the chance that agents can access or modify shared state without clear user awareness, review, or restriction, which can enable prompt-injection persistence and unintended data tampering.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

This skill is intentionally designed to persist cross-agent context in shared files so future agents read and act on prior outputs. That creates a session-persistence channel where untrusted or compromised agent output can influence later decisions, effectively propagating prompt injection, poisoned content, or malicious coordination across agents without direct messaging.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: agent-relay
version: 1.0.0
description: |
  Cross-agent context sharing via shared files. Agents write trends, highlights, 
  and signals to a shared folder. Other agents read before acting — creating 
  coordinated behavior without direct messaging.
  Use when: multi-agent setups need coordination, agents should know what other

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill includes commands that add data and delete entries via cleanup, but it does not warn users that running it will modify or remove shared JSON data used by other agents. Because this shared state influences later agent behavior, silent modification or deletion can cause integrity issues, coordination mistakes, or erase evidence of prior activity.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.