Call Center

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:27 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent call-center helper, but it asks agents to keep customer and escalation details in local plaintext files without privacy, retention, or access-control safeguards.

Review before installing in any real support environment. Use only with approved customer-data systems, avoid storing payment data, credentials, government IDs, or unnecessary personal details in local markdown, and require clear retention, deletion, and access-control rules if local notes are allowed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: memory-template.md:3

Finding

Customer Data Persisted in Unprotected Plaintext Markdown Files

Content

View full analysis

Vulnerability Details

File Location: memory-template.md:3-9
Supporting Locations: memory-template.md:18-38, memory-template.md:45-60, escalation.md:35-50, scripts.md:77-81, scripts.md:108-113, SKILL.md:51-54
Vulnerability Type: Insecure local storage of sensitive customer information
Risk Level: Medium

Vulnerable Code Snippets

memory-template.md:3-9:

bash

## Initial Setup

Create directory on first use:
```bash
mkdir -p ~/call-center/scripts
touch ~/call-center/memory.md
touch ~/call-center/escalations.md
touch ~/call-center/metrics.md

text

`memory-template.md:18-38`:

```markdown
## Active Calls
<!-- Current call in progress -->
| Time | Caller | Issue | Status |
|------|--------|-------|--------|

## Recent Interactions
<!-- Last 10 calls for pattern recognition -->
| Date | Caller | Type | Resolution | Duration |
|------|--------|------|------------|----------|

## Open Follow-ups
<!-- Promised callbacks or pending actions -->
| Due | Caller | Promise | Ref# |
|-----|--------|---------|------|

## Known Issues
<!-- Recurring problems to watch for -->
- [Issue]: [Quick resolution or escalation path]

## Caller Preferences
<!-- VIP or frequent callers with notes -->
| Caller | Preference | Notes |
|--------|------------|-------|

memory-template.md:45-60:

markdown

# Escalation Log

## Pending Escalations
| Date | Caller | Issue | Escalated To | Status |
|------|--------|-------|--------------|--------|

## Escalation Patterns
<!-- Issues that frequently escalate — candidates for process improvement -->
| Issue Type | Frequency | Root Cause | Suggested Fix |
|------------|-----------|------------|---------------|

## Escalation Contacts
| Department | Contact | Hours | Use For |
|------------|---------|-------|---------|
| Supervisor | [Name] | 9-5 | Customer requests, auth issues |
| Technical | [Team] | 24/7 | System outages, bugs |
| Billing | [Team] | 9-6 | Disp
...[truncated 3374 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer an approved system of record

   • Store customer interactions in an access-controlled CRM or case-management system.
   • Avoid duplicating customer data in local Markdown files.

2. Enforce restrictive permissions if local storage is unavoidable

   • Create the directory and files with owner-only access:

   bash

   install -d -m 0700 "$HOME/call-center/scripts"
   install -m 0600 /dev/null "$HOME/call-center/memory.md"
   install -m 0600 /dev/null "$HOME/call-center/escalations.md"
   install -m 0600 /dev/null "$HOME/call-center/metrics.md"
   

   • Validate existing permissions before every use and fail safely if they are too broad.
   • Do not rely solely on the ambient umask.

3. Minimize collected data

   • Use opaque CRM or case identifiers rather than names, phone numbers, email addresses, or account numbers.
   • Prohibit storage of credentials, authentication answers, payment-card data, government identifiers, and unnecessary verbatim statements.
   • Redact sensitive legal, fraud, medical, and safety details unless operationally required.

4. Protect data at rest

   • Encrypt sensitive local records with organization-managed keys.
   • Ensure encryption keys are not stored beside the records.
   • Restrict backup, synchronization, indexing, and telemetry tools from collecting the directory unless explicitly approved.

5. Define lifecycle controls

   • Establish documented retention periods for active calls, recent interactions, preferences, and escalation logs.
   • Automatically purge expired records and use an approved secure-deletion process where required.
   • Remove resolved follow-ups and obsolete caller preferences promptly.

6. Add privacy and access safeguards

   • Document the lawful or organizational basis for collection.
   • Limit record access by role and maintain access audit logs.
   • Require review and approval before recording particularly sensitive legal, fraud, or s ...[truncated 130 chars]

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly directs storing call memory in local files and later instructs updating CRM interaction notes, but it never warns about minimizing, redacting, securing, or limiting retention of sensitive customer information. In a call-center context, agents routinely handle PII, account details, payment issues, and potentially regulated data, so normalizing unrestricted note-taking increases the risk of privacy violations, over-collection, and accidental disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation section tells the agent to log call reasons, actions, resolutions, and promises made, but omits any warning about privacy, consent, or compliance boundaries when recording customer interactions. Because these notes can easily include personal, financial, health, or legal information, the lack of safeguards makes oversharing into logs and downstream systems more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The guide directs agents to collect and relay caller name, contact details, issue summaries, and mood to a supervisor without any minimization, confidentiality, or approved-channel guidance. In a call-center context this creates a real risk of unnecessary exposure of personal data during transfer, logging, or verbal briefing, especially when issues may involve fraud, legal matters, or compliance concerns.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The instruction to record the escalation in a log lacks safeguards for sensitive customer or incident information, which can lead to overcollection and long-term storage of personal or legally sensitive details. Because this skill explicitly covers legal threats, fraud, safety concerns, and compliance issues, the absence of storage restrictions makes the context more dangerous, not less.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The template explicitly directs operators to store caller names, interaction histories, follow-up promises, issue details, and caller preferences in local markdown files without any guidance on data minimization, access controls, retention, or handling of sensitive information. In a call-center context, these fields can easily contain PII or regulated customer data, increasing the risk of privacy violations, unauthorized disclosure, and unsafe long-term retention.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The markdown instructs agents to request account numbers, email addresses, or the last 4 digits of a phone number for verification, which involves collecting user data. There is no accompanying warning about safeguarding this information, minimizing collection, or following privacy procedures.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.