T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:8- Finding
Mandatory Global Memory Protocol Hijacks Agent Behavior
- Content
View full analysis
- Remediation
View remediation
Security audit
Memory Ops
Security checks for vulnerabilities and agentic risk
Overview
This PostgreSQL memory skill is disclosed as a memory tool, but it broadly requires saving prompts and handoffs into shared long-term memory and seeds persistent behavioral rules, so it needs user review before use.
Install only in a private, single-user environment after replacing the hardcoded identity and global scope with authenticated tenant/user/session parameters. Do not store raw prompts or delegation payloads by default; add consent, redaction, retention, deletion, and access controls before using this with sensitive or shared data. Remove the seeded behavioral rules from the bootstrap script unless they are explicitly intended and user-approved.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T02 · Agent Memory Poisoning
Error
- Location
scripts/memory_ops_template.sql:4- Finding
Bootstrap Script Poisons Persistent Agent Memory with Behavioral Rules
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/queries.sql:1- Finding
Hardcoded Global User Namespace Enables Cross-Session Data Mixing
- Content
View full analysis
:query_embedding)) AS similarity FROM memories WHERE user_id = 'ian' ORDER BY embedding <=> :query_embedding LIMIT 8; -- 2) Write user prompt context INSERT INTO memories (user_id, scope, source, content, metadata, importance) VALUES ( 'ian', 'global', 'chat', :prompt_content, jsonb_build_object( 'kind','user_prompt', 'agent','jarvis', 'channel',:channel, 'timestamp',now() ), 4 ) RETURNING id; -- 3) Write delegation prompt INSERT INTO memories (user_id, scope, source, content, metadata, importance) VALUES ( 'ian', 'global', 'chat', :delegation_prompt, jsonb_build_object( 'kind','delegation_prompt', 'agent','jarvis', 'target_agent',:target_agent, 'timestamp',now() ), 4 ) RETURNING id; -- 4) Write delegation result summary INSERT INTO memories (user_id, scope, source, content, metadata, importance) VALUES ( 'ian', 'global', 'chat', :delegation_result, jsonb_build_object( 'kind','delegation_result', 'agent','jarvis', 'target_agent',:target_agent, 'timestamp',now() ), 3 ) RETURNING id; ``` The schema reinforces the unsafe defaults in `references/schema.sql`, lines 4-15: ```sql CREATE TABLE IF NOT EXISTS memories ( id BIGSERIAL PRIMARY KEY, user_id TEXT NOT NULL DEFAULT 'ian', scope TEXT NOT NULL DEFAULT 'global', source TEXT NOT NULL DEFAULT 'chat', content TEXT NOT NULL, metadata JSONB NOT NULL DEFAULT '{}'::jsonb, embedding vector(1536), importance SMALLINT NOT NULL DEFAULT 3, created_at TIMESTAMPTZ NOT NULL DEFAULT now(), updated_at TIMESTAMPTZ NOT NULL DEFAULT now(), last_accessed_at TIMESTAMPTZ ); ``` ### T ...[truncated 2170 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
These instructions mandate saving user prompt context and every delegation context to persistent storage, but they do not require notice, consent, minimization, or retention controls. In practice this can capture sensitive personal, operational, or confidential data and preserve it in a database and audit trail, creating a significant privacy and data-exposure risk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The invocation description is extremely broad: it says to use the skill when responding, delegating tasks, consolidating user context, and maintaining operational history. That scope can cause the skill to activate for routine conversations and systematically route ordinary user content into persistence workflows, increasing privacy and over-collection risk beyond what users would reasonably expect.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The skill description is written as an unconditional Portuguese operational instruction and does not indicate that language can vary based on user preference. This can constitute a language/locale policy issue when a skill implicitly forces one language without opt-in or documented justification.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Mandatory logging of every prompt and delegation artifact creates a durable natural-language record that may include secrets, personal data, internal instructions, or third-party confidential information. Because the skill makes this logging part of the normal turn cycle, the surrounding context makes the leak/retention risk more dangerous by turning occasional exposure into systematic collection.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The handoff workflow explicitly requires storing both delegation prompts and delegation results in memory. Those artifacts often contain user context, hidden system instructions, or sensitive task details, so preserving them in plain-language memory broadens the blast radius of any database access, misuse, or later retrieval error.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This SQL persists raw user prompt content into a long-term memories table, and there is no indication in this file of consent, minimization, redaction, or retention controls. Storing prompts can capture secrets, personal data, or regulated content, increasing privacy and compliance risk if the data is later queried, exposed, or reused unexpectedly.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file stores delegation prompts and delegation results, which may contain internal instructions, sensitive user data, model outputs, or cross-agent context, without any visible warning or guardrails. Persisting agent-to-agent content broadens the attack surface for prompt leakage, sensitive data retention, and unintended later retrieval by semantic search.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The seeded memory content is written entirely in Portuguese and encodes agent behavior directives without offering any language choice. This can violate language/locale policy when the skill implicitly constrains operation or outputs to a specific language absent documented user opt-in or region-specific justification.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The seeded rule explicitly says to save the context of every received and delegated prompt, which promotes indiscriminate retention of potentially sensitive user data, secrets, and third-party content. In a memory system, this can expand the blast radius of any later memory read, leak, misuse, or compromise and may also create privacy and compliance issues.
- Content
Static analysis
No suspicious patterns detected.