T09 · Insecure Skill Coding Practices
Warning
- Location
memory-template.md:9- Finding
Persistent Plaintext Storage of Personal Travel and Booking Data
- Content
View full analysis
- Remediation
View remediation
Security audit
New Zealand
Security checks for vulnerabilities and agentic risk
Overview
This is a normal New Zealand travel guide, but it needs review because it automatically saves and silently reuses plaintext trip details that may include sensitive booking, family, dietary, or mobility information.
Review this before installing if you do not want a local trip-memory file. If you use it, avoid storing passport numbers, payment details, ticket barcodes, full booking confirmation codes, or exact sensitive family/accessibility details in ~/new-zealand/memory.md, and delete or edit that file when the trip is done.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Treating all beaches as relaxed Mediterranean swimming beaches. - Taking children into exposed surf zones because locals are nearby. - Planning Cathedral Cove-type stops without checking current access conditions.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Treating all beaches as relaxed Mediterranean swimming beaches. - Taking children into exposed surf zones because locals are nearby. - Planning Cathedral Cove-type stops without checking current access conditions.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The phrase "When the user first brings up New Zealand travel" is an ambiguous activation condition for a markdown skill. It does not define clear trigger phrases, scope boundaries, or exclusion cases, so ordinary conversation about New Zealand travel could unintentionally invoke the setup behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to create persistent local storage for trip details without telling the user that their information will be saved. This creates a privacy risk because itinerary, dates, constraints, and preferences can be retained across sessions without informed consent or clear retention boundaries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instruction to read previously saved memory 'silently' means the skill accesses stored user information without notifying the user at the time of access. Even if the data is only reused for convenience, undisclosed retrieval of prior personal preferences and travel history undermines transparency and can violate user expectations around privacy.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This skill content is written only in English and does not indicate that users can opt into another language or locale. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
This markdown template includes a 'Bookings Made' section with a 'Confirmation' field, which invites users to record reservation identifiers or other potentially sensitive travel data. The file does not include any warning or guidance about avoiding sensitive personal or booking information, despite collecting data that could affect user privacy.
- Content