Real Estate Agent

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:45 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent real-estate assistant, but it stores sensitive housing and financial details persistently and also writes an activation preference to undefined main memory outside its declared local folder.

Install only if you are comfortable with the assistant keeping a persistent local real-estate profile. Review ~/real-estate-agent/ regularly, avoid storing precise preapproval, lender, relocation, family, or negotiation details unless needed, and be aware that the skill also asks to save activation preferences in broader main memory for future sessions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: setup.md:18

Finding

Persistent Cross-Session State Modification Outside the Declared Skill Boundary

Content

View full analysis

Vulnerability Details

File Location: setup.md, lines 18-22 and 68-72; conflicting security boundary in SKILL.md, lines 132-140
Vulnerability Type: Persistent modification of undefined global Agent memory
Risk Level: Medium

Vulnerable Code Snippet

From setup.md, lines 18-22:

markdown

Ask about their involvement preference:
- "Should I alert you when I spot opportunities matching your criteria?"
- "Want me to track price changes on properties you're watching?"
- "Should I remind you of important dates — lease renewals, inspection deadlines?"

**Wait for explicit answers before committing.** Once they say yes, confirm: "Got it, I'll keep an eye out and let you know when something matches." Then save to their MAIN memory so other sessions know to activate this skill.

From setup.md, lines 68-72:

markdown

With their consent (after they answer integration questions):
- **Integration preference** → Main memory (so skill activates appropriately)
- **Client profile** → ~/real-estate-agent/memory.md
- **Search criteria** → ~/real-estate-agent/searches/
- **Watched properties** → ~/real-estate-agent/properties/

The instruction conflicts with the declared boundary in SKILL.md, lines 132-140:

markdown

**Data that stays local:**
- All client information in ~/real-estate-agent/
- Property searches and preferences
- Viewing history and notes
- Budget ranges and pre-approval amounts (basic financial context)

**This skill does NOT:**
- Send data to external services
- Store bank account numbers, full mortgage documents, or passwords
- Make purchases or sign agreements on behalf of the client
- Access files outside ~/real-estate-agent/

Technical Analysis

The setup instructions explicitly direct the Agent to write an integration preference into an undefined “MAIN memory” so the Skill will activate in other sessions. This operation is outside the Skill-specific storage hierarchy documented as ~/real-estate-agent/.

A ...[truncated 2089 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all instructions to write to undefined “MAIN memory.”

2. Store integration preferences only in the documented scoped file:

   text

   ~/real-estate-agent/memory.md
   

3. Replace the vulnerable instruction with an explicitly scoped rule, such as:

   markdown

   After explicit consent, save the preference only to
   `~/real-estate-agent/memory.md`. Do not modify global Agent memory or
   state belonging to other skills.
   

4. Require explicit activation in each session unless the host platform provides a formally scoped Skill-preference mechanism.

5. If platform-level activation state is required, use a documented API with:

   • A fixed schema.
   • Skill-specific namespacing.
   • User-visible state.
   • Revocation controls.
   • Expiration or review dates.
   • Protection against arbitrary instruction text.

6. Reconcile setup.md with the security statement in SKILL.md so every permitted write target is accurately disclosed.

7. Add a negative requirement prohibiting writes to global memory, system prompts, other skills’ memory, and files outside the declared directory.

T09 · Insecure Skill Coding Practices

Warning

• Location: memory-template.md:169

Finding

Excessive Collection and Indefinite Plaintext Retention of Sensitive Client Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 56; memory-template.md, lines 25-56 and 169-173; memory.md, lines 25-40 and 49-54
Vulnerability Type: Overcollection and indefinite plaintext retention of personal and financial information
Risk Level: Medium

Vulnerable Code Snippet

From SKILL.md, line 56:

markdown

Update `memory.md` with every new piece of information. A good agent remembers everything.

From memory-template.md, lines 25-56:

markdown

## Buyer/Renter Profile
<!-- If applicable -->
budget_range: 
locations: 
property_types: 
must_haves: 
nice_to_haves: 
deal_breakers: 
financing_status: 
preapproval: 

## Seller/Landlord Profile
<!-- If applicable -->
properties_owned: 
listing_status: 
price_expectations: 
pain_points: 

## Investor Profile
<!-- If applicable -->
strategy: 
target_returns: 
risk_tolerance: 
portfolio: 

## Preferences
alerts: 
update_frequency: 
detail_level: 
portals_used: 

## Notes
<!-- Anything else relevant — family situation, job relocation, etc. -->

From memory-template.md, lines 169-173:

markdown

1. **Update proactively** — Every conversation should enrich the client profile
2. **Track everything** — Properties discussed, prices seen, decisions made
3. **Price history matters** — Always log price changes for context
4. **Separate concerns** — One file per property, one file per search
5. **Archive don't delete** — Move closed deals to archive/, never lose history

The included example in memory.md, lines 25-40, demonstrates plaintext financial and personal storage:

markdown

## Buyer Profile
budget_range: 350,000 - 400,000 EUR
locations: Madrid Centro, Salamanca, Chamberi
property_types: apartment
must_haves: elevator, natural light, quiet street
nice_to_haves: balcony, parking, storage
deal_breakers: ground floor, busy street, no elevator
financing_status: pre-approved
preapproval: 380,000 EUR from Santander

## Preferences
alerts: yes, when new listings m
...[truncated 3072 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace “remember everything” and “track everything” with purpose-limited collection requirements.
2. Obtain explicit, granular consent before retaining sensitive categories, including:
   • Financing and preapproval information.
   • Lender identity.
   • Family circumstances.
   • Relocation information.
   • Property ownership and portfolio information.
   • Offers and negotiation history.
3. Make sensitive fields optional and disabled by default. Store only coarse information where sufficient, such as a budget band rather than an exact preapproval amount or lender.
4. Define retention periods by record type. For example:
   • Pending alerts: delete after delivery or a short expiration period.
   • Inactive searches: delete after a user-configurable interval.
   • Closed transaction records: ask whether to delete, export, or archive.
   • Sensitive financing details: delete when no longer required.
5. Replace “Archive don't delete” with user-controlled retention and selective deletion.
6. Provide commands or documented procedures to:
   • Review all stored data.
   • Correct individual fields.
   • Delete specific properties or searches.
   • Purge sensitive fields.
   • Erase the complete profile.
7. Require restrictive filesystem permissions when creating directories and files, permitting access only to the current user where supported.
8. Avoid recording secrets, account numbers, identity documents, complete contracts, or unredacted mortgage documents.
9. Warn users that local plaintext files may be included in backups or synchronization tools.
10. Record consent state and purpose for each sensitive category rather than treating consent to alerts as consent to comprehensive profiling.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md

- Budget ranges and pre-approval amounts (basic financial context)

**This skill does NOT:**
- Send data to external services
- Store bank account numbers, full mortgage documents, or passwords
- Make purchases or sign agreements on behalf of the client
- Access files outside ~/real-estate-agent/

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · memory-template.md (reported line 16)May include surrounding context.

md

integration: pending

## Client Role
<!-- buyer | seller | landlord | tenant | investor | agent | multiple -->

## Timeline
<!-- urgent (days) | active (weeks) | exploring (months) | ongoing -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · memory-template.md (reported line 43)May include surrounding context.

md

pain_points: 

## Investor Profile
<!-- If applicable -->
strategy: 
target_returns: 
risk_tolerance:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation condition is very broad: any discussion of buying, selling, renting, investing, or property management can trigger the skill. This increases the chance of unintended invocation in loosely related conversations, causing the agent to begin collecting and persisting sensitive housing and financial context without sufficiently clear user intent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md

- Budget ranges and pre-approval amounts (basic financial context)

**This skill does NOT:**
- Send data to external services
- Store bank account numbers, full mortgage documents, or passwords
- Make purchases or sign agreements on behalf of the client
- Access files outside ~/real-estate-agent/

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The template directs the agent to persist a wide range of client and transaction data, including family situation, job relocation, financing status, properties owned, and detailed property notes, but provides no privacy notice, retention limits, consent model, or handling restrictions. In a real-estate context this data is sensitive and linkable, so broad default storage increases the risk of unnecessary collection, over-retention, and downstream disclosure.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The principles 'Track everything' and 'Archive don't delete' encourage indefinite cross-conversation retention of broad personal and transactional history without boundaries. That creates an over-collection and over-retention pattern that can expose users to privacy harm if the memory store is later accessed, reused out of context, or leaked.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly states it will create and continuously update a persistent memory file containing highly sensitive personal and financial details such as budget, location preferences, relocation plans, and mortgage preapproval information, but it does not warn the user in the skill description or obtain clear informed consent. This creates a privacy and data-minimization risk because users may disclose sensitive information without realizing it will be stored long-term and reused across sessions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup text says to engage whenever the user is merely discussing real estate, which creates an overbroad activation condition. That can cause the agent to begin collecting preferences, timelines, and other sensitive housing-related details without a clearly scoped request, increasing the risk of unwanted persistence and privacy-invasive behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs the agent to store client profiles, search criteria, watched properties, and integration preferences locally, but it does not provide a meaningful privacy warning or informed-consent flow about the sensitivity and persistence of this data. Real-estate information can reveal finances, location preferences, moving plans, and occupancy patterns, so silent or underexplained storage increases privacy and safety risks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.