T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:42- Finding
Automatic Persistent Storage of Broad Organizational and Security Metadata
- Content
View full analysis
- Remediation
View remediation
Security audit
Cybersecurity
Security checks for vulnerabilities and agentic risk
Overview
This defensive cybersecurity skill is coherent and not malicious, but it automatically reads, writes, and sometimes deletes sensitive local security records without asking each time.
Install only if you want Codex to maintain a local cybersecurity knowledge base under ~/Clawic/data. Treat those files as sensitive: restrict file permissions, consider encryption or approved secure storage, review backups/sync settings, and periodically inspect or delete stale inventories. Keep live-system actions under written authorization and require explicit confirmation for any destructive or noisy operation.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (26)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md **Entities go to the shared inventories, not into a private copy**: hosts and servers to `~/Clawic/data/servers/servers.md`, people to `~/Clawic/data/contacts/contacts.md`, domains and their DNS to `~/Clawic/data/domains/domains.md`, laptops and other endpoints to `~/Clawic/data/devices/devices.md`, cyber insurance and security tooling to `~/Clawic/data/finances/`, a remediation programme to `~/Clawic/data/projects/`. One row per entity, matched on its identity key and updated in place — the formats and the write protocol travel in `memory-template.md`, because the user may have none of the other skills installed. **Evidence is not memory, and no credential is ever written anywhere under `~/Clawic/data/`** — not in the files named here, not in a file you create, not in text the user pastes in to be saved. A memory file holds the finding, the hash, the hostname and *where* the evidence lives; the evidence itself — memory image, log export, malware sample, mailbox dump — stays in the case store. Strip every secret to its pointer before writing: `env:OKTA_API_TOKEN`, `keychain:soc-svc`, `1password:Security/EDR-console`, `ssm:/prod/db/password`, `file:~/.ssh/id_ed25519`. Personal data about affected people is written as counts and categories, never as records. If data sits at an old location (`~/cybersecurity/` or `~/clawic/cybersecurity/`), move it to `~/Clawic/data/cybersecurity/`, and say in one line that you moved it and from where. Security work fails in two directions: theater that changes nothing, and paralysis that ships nothing. Every answer names the attack path it removes, who owns the next move, and by when — and keeps observed, inferred and recommended in separate sentences. Work from defaults immediately: never open with questions about their environment, their tooling, or how proactive to be. Precedence for any value: `config.yaml` → `~/Clawic/profile.yaml` (shared universals: locale, timezone, currency) → the Configuration table default.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md **Entities go to the shared inventories, not into a private copy**: hosts and servers to `~/Clawic/data/servers/servers.md`, people to `~/Clawic/data/contacts/contacts.md`, domains and their DNS to `~/Clawic/data/domains/domains.md`, laptops and other endpoints to `~/Clawic/data/devices/devices.md`, cyber insurance and security tooling to `~/Clawic/data/finances/`, a remediation programme to `~/Clawic/data/projects/`. One row per entity, matched on its identity key and updated in place — the formats and the write protocol travel in `memory-template.md`, because the user may have none of the other skills installed. **Evidence is not memory, and no credential is ever written anywhere under `~/Clawic/data/`** — not in the files named here, not in a file you create, not in text the user pastes in to be saved. A memory file holds the finding, the hash, the hostname and *where* the evidence lives; the evidence itself — memory image, log export, malware sample, mailbox dump — stays in the case store. Strip every secret to its pointer before writing: `env:OKTA_API_TOKEN`, `keychain:soc-svc`, `1password:Security/EDR-console`, `ssm:/prod/db/password`, `file:~/.ssh/id_ed25519`. Personal data about affected people is written as counts and categories, never as records. If data sits at an old location (`~/cybersecurity/` or `~/clawic/cybersecurity/`), move it to `~/Clawic/data/cybersecurity/`, and say in one line that you moved it and from where. Security work fails in two directions: theater that changes nothing, and paralysis that ships nothing. Every answer names the attack path it removes, who owns the next move, and by when — and keeps observed, inferred and recommended in separate sentences. Work from defaults immediately: never open with questions about their environment, their tooling, or how proactive to be. Precedence for any value: `config.yaml` → `~/Clawic/profile.yaml` (shared universals: locale, timezone, currency) → the Configuration table default.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md **Entities go to the shared inventories, not into a private copy**: hosts and servers to `~/Clawic/data/servers/servers.md`, people to `~/Clawic/data/contacts/contacts.md`, domains and their DNS to `~/Clawic/data/domains/domains.md`, laptops and other endpoints to `~/Clawic/data/devices/devices.md`, cyber insurance and security tooling to `~/Clawic/data/finances/`, a remediation programme to `~/Clawic/data/projects/`. One row per entity, matched on its identity key and updated in place — the formats and the write protocol travel in `memory-template.md`, because the user may have none of the other skills installed. **Evidence is not memory, and no credential is ever written anywhere under `~/Clawic/data/`** — not in the files named here, not in a file you create, not in text the user pastes in to be saved. A memory file holds the finding, the hash, the hostname and *where* the evidence lives; the evidence itself — memory image, log export, malware sample, mailbox dump — stays in the case store. Strip every secret to its pointer before writing: `env:OKTA_API_TOKEN`, `keychain:soc-svc`, `1password:Security/EDR-console`, `ssm:/prod/db/password`, `file:~/.ssh/id_ed25519`. Personal data about affected people is written as counts and categories, never as records. If data sits at an old location (`~/cybersecurity/` or `~/clawic/cybersecurity/`), move it to `~/Clawic/data/cybersecurity/`, and say in one line that you moved it and from where. Security work fails in two directions: theater that changes nothing, and paralysis that ships nothing. Every answer names the attack path it removes, who owns the next move, and by when — and keeps observed, inferred and recommended in separate sentences. Work from defaults immediately: never open with questions about their environment, their tooling, or how proactive to be. Precedence for any value: `config.yaml` → `~/Clawic/profile.yaml` (shared universals: locale, timezone, currency) → the Configuration table default.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | Dependencies, build pipeline, an acquired repo, a vendor questionnaire | Reachability over CVE count, build integrity, vendor tiering | `supply-chain.md` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | Dependencies, build pipeline, an acquired repo, a vendor questionnaire | Reachability over CVE count, build integrity, vendor tiering | `supply-chain.md` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | Dependencies, build pipeline, an acquired repo, a vendor questionnaire | Reachability over CVE count, build integrity, vendor tiering | `supply-chain.md` |
Privileged Container / Container Escape
High
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Potential security issue detected. Manual review is recommended.
- Content
md - Minimal package surface: no compilers, no unnecessary daemons, and a host firewall that permits only the service ports. - **Immutable infrastructure beats patching where it is achievable**: rebuild from a new image rather than updating in place, and the drift problem disappears with it. - SELinux or AppArmor in enforcing mode. Disabling it "temporarily" is permanent in every environment where it has ever happened. - Containers: a compromised container's filesystem disappears on restart, so capture from the host during an incident (`forensics.md`), and treat the image as the durable artifact. Container escape is a real path — no `--privileged`, drop capabilities, non-root user, read-only root filesystem. ## Mobile
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - `auth.log` / `secure` for authentication and sudo; `journalctl` for the systemd view; `wtmp`, `btmp`, `lastlog` for sessions — all trivially editable by root, so treat them as leads and corroborate with a second source. - **auditd is the only real answer for execution** on Linux, and it must be configured beforehand. Without it, execution evidence is largely absent and honest reporting says so. - Persistence sweep: `crontab -l` for every user plus `/etc/cron*`, systemd units and timers (including user units under `~/.config/systemd/user`), `~/.ssh/authorized_keys` on every account, `LD_PRELOAD` and `/etc/ld.so.preload`, shell rc files, `/etc/passwd` entries with UID 0 or a new shell, kernel modules, and package-manager hooks. - Containers evaporate: a compromised container's filesystem disappears on restart. Capture from the host — the container's writable layer under the runtime's storage directory, plus the image digest and the runtime logs — and treat the image itself as the durable artifact (`endpoints.md` covers what EDR sees inside containers). - Timestamps: `ctime` cannot be set by ordinary tooling the way `mtime` can, so a file whose `mtime` predates its `ctime` by a suspicious margin is a timestomping tell.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - `auth.log` / `secure` for authentication and sudo; `journalctl` for the systemd view; `wtmp`, `btmp`, `lastlog` for sessions — all trivially editable by root, so treat them as leads and corroborate with a second source. - **auditd is the only real answer for execution** on Linux, and it must be configured beforehand. Without it, execution evidence is largely absent and honest reporting says so. - Persistence sweep: `crontab -l` for every user plus `/etc/cron*`, systemd units and timers (including user units under `~/.config/systemd/user`), `~/.ssh/authorized_keys` on every account, `LD_PRELOAD` and `/etc/ld.so.preload`, shell rc files, `/etc/passwd` entries with UID 0 or a new shell, kernel modules, and package-manager hooks. - Containers evaporate: a compromised container's filesystem disappears on restart. Capture from the host — the container's writable layer under the runtime's storage directory, plus the image digest and the runtime logs — and treat the image itself as the durable artifact (`endpoints.md` covers what EDR sees inside containers). - Timestamps: `ctime` cannot be set by ordinary tooling the way `mtime` can, so a file whose `mtime` predates its `ctime` by a suspicious margin is a timestomping tell.
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
md for authentication and sudo; `journalctl` for the systemd view; `wtmp`, `btmp`, `lastlog` for sessions — all trivially editable by root, so treat them as leads and corroborate with a second source. - **auditd is the only real answer for execution** on Linux, and it must be configured beforehand. Without it, execution evidence is largely absent and honest reporting says so. - Persistence sweep: `crontab -l` for every user plus `/etc/cron*`, systemd units and timers (including user units under `~/.config/systemd/user`), `~/.ssh/authorized_keys` on every account, `LD_PRELOAD` and `/etc/ld.so.preload`, shell rc files, `/etc/passwd` entries with UID 0 or a new shell, kernel modules, and package-manager hooks. - Containers evaporate: a compromised container's filesystem disappears on restart. Capture from the host — the container's writable layer under the runtime's storage directory, plus the image digest and the runtime logs — and treat the image itself as the durable artifact (`endp
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 1. **Revoke refresh tokens and sign out every session** — before the password reset, not after. Reset-first leaves a window in which the live session re-establishes itself. 2. **Reset the password**, and set it, do not mail a reset link to a mailbox the attacker reads. 3. **Access tokens already issued keep working until they expire** — commonly up to an hour. Where continuous access evaluation exists, enable it: it is what turns revocation from "eventually" into near-real-time. Where it does not, state the window out loud, because it is the window in which containment is not yet true. 4. **Review and remove registered authentication methods** — attacker-added phone numbers, authenticator apps and security keys. An attacker-enrolled factor makes the account look *more* secure than before, which is why this step gets skipped. 5. **Revoke OAuth grants and consented applications** for that user, and check tenant-wide consent for new applications and service principals. This is token persistence that survives every password reset ever performed. 6. **Remove device registrations and enrolments** created in the window. A registered device can hold a long-lived primary refresh token that no session revocation touches.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 5. **Revoke OAuth grants and consented applications** for that user, and check tenant-wide consent for new applications and service principals. This is token persistence that survives every password reset ever performed. 6. **Remove device registrations and enrolments** created in the window. A registered device can hold a long-lived primary refresh token that no session revocation touches. 7. **Rotate application passwords and legacy-protocol credentials**, which exist precisely because they bypass MFA. 8. **Rotate API keys, personal access tokens and SSH keys** owned by that identity, in every system: the git host, the cloud provider, the CI platform, the ticketing system. 9. **Delete mail rules, forwarding, delegates and "send as"** created in the window (`phishing.md` has the full mailbox sweep). 10. **Check group memberships and role assignments** granted during the window, including nested groups and eligible-but-not-active roles. 11. **Check for new accounts** created by the compromised identity — the second door built while you were closing the first.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 5. **Revoke OAuth grants and consented applications** for that user, and check tenant-wide consent for new applications and service principals. This is token persistence that survives every password reset ever performed. 6. **Remove device registrations and enrolments** created in the window. A registered device can hold a long-lived primary refresh token that no session revocation touches. 7. **Rotate application passwords and legacy-protocol credentials**, which exist precisely because they bypass MFA. 8. **Rotate API keys, personal access tokens and SSH keys** owned by that identity, in every system: the git host, the cloud provider, the CI platform, the ticketing system. 9. **Delete mail rules, forwarding, delegates and "send as"** created in the window (`phishing.md` has the full mailbox sweep). 10. **Check group memberships and role assignments** granted during the window, including nested groups and eligible-but-not-active roles. 11. **Check for new accounts** created by the compromised identity — the second door built while you were closing the first.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 5. **Revoke OAuth grants and consented applications** for that user, and check tenant-wide consent for new applications and service principals. This is token persistence that survives every password reset ever performed. 6. **Remove device registrations and enrolments** created in the window. A registered device can hold a long-lived primary refresh token that no session revocation touches. 7. **Rotate application passwords and legacy-protocol credentials**, which exist precisely because they bypass MFA. 8. **Rotate API keys, personal access tokens and SSH keys** owned by that identity, in every system: the git host, the cloud provider, the CI platform, the ticketing system. 9. **Delete mail rules, forwarding, delegates and "send as"** created in the window (`phishing.md` has the full mailbox sweep). 10. **Check group memberships and role assignments** granted during the window, including nested groups and eligible-but-not-active roles. 11. **Check for new accounts** created by the compromised identity — the second door built while you were closing the first.
YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md ud or cybercrime channel — in the US the FBI's IC3 operates a Recovery Asset Team that can freeze domestic transfers, and its effectiveness collapses after the first day. 3. Notify the receiving bank in writing that the account is receiving fraudulent funds. 4. Preserve everything: the full message with headers, the invoice, the approval trail, the payment instruction. 5. Notify the insurer — social-engineering fraud is often a separate policy sub-limit from the cyber cover, and the claim has notice requirements of its own. Then the security question: which mailbox was compromised, yours or theirs? If theirs, you still have an incident — every thread that party sees is exposed, and the same actor will try the pattern on their other customers. ## Tenant-Wide Hunt One reported message is a sample. Search the estate for: the sender address and its domain, the sending IP and ASN, the URL and its domain, the attachment hash, and the subject pattern. Then hunt for the *outcome* rath
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
- Content
md - **Tooling** — scanner, ticketing system, secrets manager, MDM, mail gateway, vulnerability and asset sources of truth — affects where every finding and every log query is expressed - **Conventions** — finding id scheme, severity wording, ticket titles, naming of assets and environments, report template — affects `reporting.md` and every artifact written - **Platform** — identity provider, OS mix across the fleet, on-prem versus cloud weighting, OT/ICS or medical devices in scope — affects `identity.md`, `endpoints.md` and which scans are safe at all - **Safety posture** — whether the agent may run any command against live systems or only describe them, appetite for noisy or attacker-visible actions, approval chain for containment — affects Rule 1, Output Gates and `authorization.md` - **Exclusions** — systems never to touch, third parties out of scope, jurisdictions with distinct rules, data the user will not have summarized — affects the authorization gate and evidence handling - **Cadence** — access reviews, key rotation, restore drills, tabletops, pentests, phishing simulations, vendor reassessment — every accepted cadence becomes a row in the `## Due` table of `memory.md` - **Output register** — timeline-first versus recommendation-first, how much attacker detail to include, whether to name techniques by ATT&CK id — affects every answer's shape
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
md 2. **Every place user input reaches an interpreter**: SQL, shell, template, deserializer, XML parser, LDAP filter, NoSQL query, or a URL the server will fetch. 3. **Every trust boundary crossing**: the webhook receiver, the file upload, the admin endpoint, the internal service that assumes its caller is friendly. 4. **Anything touching money, entitlements or personal data.** 5. **The framework's escape hatches**: raw query builders, `dangerouslySetInnerHTML` and equivalents, `eval`, reflection, dynamic imports, disabled CSRF, `verify=False`. Grep for these first — they are where the framework's protection was deliberately turned off, and each one is a decision somebody made in a hurry. **Broken access control leads the OWASP Top 10 (2021) and dominates real-world exploitation** for the simple reason that it needs no exotic technique: change the id and see what happens.
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md - `auth.log` / `secure` for authentication and sudo; `journalctl` for the systemd view; `wtmp`, `btmp`, `lastlog` for sessions — all trivially editable by root, so treat them as leads and corroborate with a second source. - **auditd is the only real answer for execution** on Linux, and it must be configured beforehand. Without it, execution evidence is largely absent and honest reporting says so. - Persistence sweep: `crontab -l` for every user plus `/etc/cron*`, systemd units and timers (including user units under `~/.config/systemd/user`), `~/.ssh/authorized_keys` on every account, `LD_PRELOAD` and `/etc/ld.so.preload`, shell rc files, `/etc/passwd` entries with UID 0 or a new shell, kernel modules, and package-manager hooks. - Containers evaporate: a compromised container's filesystem disappears on restart. Capture from the host — the container's writable layer under the runtime's storage directory, plus the image digest and the runtime logs — and treat the image itself as the durable artifact (`endpoints.md` covers what EDR sees inside containers). - Timestamps: `ctime` cannot be set by ordinary tooling the way `mtime` can, so a file whose `mtime` predates its `ctime` by a suspicious margin is a timestomping tell.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## The Help Desk Is An Authentication Path Every control above is bypassed by a convincing phone call if the reset procedure has no verification step. This path has been the initial access in several widely reported intrusions, and it costs nothing to close. - **Write the verification procedure down**, because a procedure that lives in each agent's judgement fails under social pressure — which is exactly the condition the attacker creates. - Verify through a channel the caller does not control: a callback to the number in the directory, confirmation by the person's manager, a video call for a known face, or an in-person check. Never verify with information an attacker can look up — date of birth, employee id, last four digits, manager's name.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The instruction "Read this file only when WRITING" does not clearly define what counts as "writing" or the boundaries of when the skill should activate versus remain inactive. Because this is a markdown file and the condition lacks explicit scope or negative examples, it could lead to unintended invocation in broadly similar contexts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The template authorizes writes and deletions ('No permission needed') and only requires a one-line announcement, not explicit user confirmation for destructive changes. In an agentic context, this can lead to unintended modification or deletion of user data, especially in shared inventories, without meaningful consent at the time of action.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The split procedure explicitly instructs the agent to delete sections from memory.md and 'never leave a copy behind' during restructuring, but does not require user approval or a reversible backup step. In a memory-management skill, automatic deletion during refactors increases the risk of data loss or corruption if the move is partial, mis-targeted, or interrupted.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill explicitly instructs reading local files containing security environment details and contact data from fixed paths without any warning, minimization guidance, or access scoping. In an agent context, that can cause unnecessary exposure of highly sensitive internal security information and enlarge the blast radius if the agent surfaces, stores, or mishandles that data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill directs the user or agent to write answers about crown jewels, logging gaps, and 3am incident contacts into local files, but does not warn that this creates or expands a sensitive repository of incident-response and organizational security data. If those files are broadly accessible, synced, or later consumed by other tools, they become a valuable target for attackers or a source of accidental disclosure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This section instructs consolidating a wide range of sensitive security records into predictable local paths, including crown jewels, trust boundaries, logging gaps, accepted risks, contacts, subscriptions, policy artifacts, and project remediation details. Centralizing this volume of high-value metadata without safeguards materially increases the impact of local compromise, overbroad agent access, or unintended downstream disclosure.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- memory-template.md:67