Security audit

Call Center

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent call-center helper, but it asks agents to keep customer and escalation details in local plaintext files without privacy, retention, or access-control safeguards.

Review before installing in any real support environment. Use only with approved customer-data systems, avoid storing payment data, credentials, government IDs, or unnecessary personal details in local markdown, and require clear retention, deletion, and access-control rules if local notes are allowed.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: memory-template.md:3
Finding: Customer Data Persisted in Unprotected Plaintext Markdown Files## Vulnerability Details **File Location**: `memory-template.md:3-9` **Supporting Locations**: `memory-template.md:18-38`, `memory-template.md:45-60`, `escalation.md:35-50`, `scripts.md:77-81`, `scripts.md:108-113`, `SKILL.md:51-54` **Vulnerability Type**: Insecure local storage of sensitive customer information **Risk Level**: Medium ### Vulnerable Code Snippets `memory-template.md:3-9`: ```bash ## Initial Setup Create directory on first use: ```bash mkdir -p ~/call-center/scripts touch ~/call-center/memory.md touch ~/call-center/escalations.md touch ~/call-center/metrics.md ``` ``` `memory-template.md:18-38`: ```markdown ## Active Calls  | Time | Caller | Issue | Status | |------|--------|-------|--------| ## Recent Interactions  | Date | Caller | Type | Resolution | Duration | |------|--------|------|------------|----------| ## Open Follow-ups  | Due | Caller | Promise | Ref# | |-----|--------|---------|------| ## Known Issues  - [Issue]: [Quick resolution or escalation path] ## Caller Preferences  | Caller | Preference | Notes | |--------|------------|-------| ``` `memory-template.md:45-60`: ```markdown # Escalation Log ## Pending Escalations | Date | Caller | Issue | Escalated To | Status | |------|--------|-------|--------------|--------| ## Escalation Patterns  | Issue Type | Frequency | Root Cause | Suggested Fix | |------------|-----------|------------|---------------| ## Escalation Contacts | Department | Contact | Hours | Use For | |------------|---------|-------|---------| | Supervisor | [Name] | 9-5 | Customer requests, auth issues | | Technical | [Team] | 24/7 | System outages, bugs | | Billing | [Team] | 9-6 | Disp ...[truncated 3374 chars]
Remediation: ## Remediation Suggestions 1. **Prefer an approved system of record** - Store customer interactions in an access-controlled CRM or case-management system. - Avoid duplicating customer data in local Markdown files. 2. **Enforce restrictive permissions if local storage is unavoidable** - Create the directory and files with owner-only access: ```bash install -d -m 0700 "$HOME/call-center/scripts" install -m 0600 /dev/null "$HOME/call-center/memory.md" install -m 0600 /dev/null "$HOME/call-center/escalations.md" install -m 0600 /dev/null "$HOME/call-center/metrics.md" ``` - Validate existing permissions before every use and fail safely if they are too broad. - Do not rely solely on the ambient `umask`. 3. **Minimize collected data** - Use opaque CRM or case identifiers rather than names, phone numbers, email addresses, or account numbers. - Prohibit storage of credentials, authentication answers, payment-card data, government identifiers, and unnecessary verbatim statements. - Redact sensitive legal, fraud, medical, and safety details unless operationally required. 4. **Protect data at rest** - Encrypt sensitive local records with organization-managed keys. - Ensure encryption keys are not stored beside the records. - Restrict backup, synchronization, indexing, and telemetry tools from collecting the directory unless explicitly approved. 5. **Define lifecycle controls** - Establish documented retention periods for active calls, recent interactions, preferences, and escalation logs. - Automatically purge expired records and use an approved secure-deletion process where required. - Remove resolved follow-ups and obsolete caller preferences promptly. 6. **Add privacy and access safeguards** - Document the lawful or organizational basis for collection. - Limit record access by role and maintain access audit logs. - Require review and approval before recording particularly sensitive legal, fraud, or s ...[truncated 130 chars]

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill explicitly directs storing call memory in local files and later instructs updating CRM interaction notes, but it never warns about minimizing, redacting, securing, or limiting retention of sensitive customer information. In a call-center context, agents routinely handle PII, account details, payment issues, and potentially regulated data, so normalizing unrestricted note-taking increases the risk of privacy violations, over-collection, and accidental disclosure.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation section tells the agent to log call reasons, actions, resolutions, and promises made, but omits any warning about privacy, consent, or compliance boundaries when recording customer interactions. Because these notes can easily include personal, financial, health, or legal information, the lack of safeguards makes oversharing into logs and downstream systems more likely.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The guide directs agents to collect and relay caller name, contact details, issue summaries, and mood to a supervisor without any minimization, confidentiality, or approved-channel guidance. In a call-center context this creates a real risk of unnecessary exposure of personal data during transfer, logging, or verbal briefing, especially when issues may involve fraud, legal matters, or compliance concerns.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The instruction to record the escalation in a log lacks safeguards for sensitive customer or incident information, which can lead to overcollection and long-term storage of personal or legally sensitive details. Because this skill explicitly covers legal threats, fraud, safety concerns, and compliance issues, the absence of storage restrictions makes the context more dangerous, not less.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The template explicitly directs operators to store caller names, interaction histories, follow-up promises, issue details, and caller preferences in local markdown files without any guidance on data minimization, access controls, retention, or handling of sensitive information. In a call-center context, these fields can easily contain PII or regulated customer data, increasing the risk of privacy violations, unauthorized disclosure, and unsafe long-term retention.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The markdown instructs agents to request account numbers, email addresses, or the last 4 digits of a phone number for verification, which involves collecting user data. There is no accompanying warning about safeguarding this information, minimizing collection, or following privacy procedures.

Static analysis

No suspicious patterns detected.