T06 · System Persistence
Error
- Location
references/agents/marketing/marketing-carousel-growth-engine.md:39- Finding
Autonomous Installation of Persistent Cron Scheduling
- Content
View full analysis
- Remediation
View remediation
Security audit
Agency Agents Wrapper
Security checks for vulnerabilities and agentic risk
Overview
This persona library is mostly documentation, but several included personas direct agents to post publicly, schedule recurring jobs, move money, or persist memory without adequate approval gates.
Review and enable only the specific persona files you need. Do not use the carousel, accounts-payable, or MCP memory personas unless you add explicit approval, dry-run, account scoping, retention, and disable controls; treat the insecure code examples as patterns to fix before copying into production.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/agents/marketing/marketing-carousel-growth-engine.md:39- Finding
Public Social-Media Publishing Without User Confirmation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/agents/engineering/engineering-feishu-integration-developer.md:545- Finding
Session JWT Disclosed Through Redirect URL Query Parameter
- Content
View full analysis
`. 6. A browser component, proxy, analytics platform, log collector, or subsequent request records or receives the complete URL. 7. An attacker with access to that record extracts the JWT. 8. The attacker replays the bearer token against the application and assumes the victim’s authenticated session, subject to token lifetime and server-side controls. ### Impact Assessment A leaked token may grant the privileges encoded in the local JWT for the affected user. De ...[truncated 488 chars]- Remediation
View remediation
T02 · Agent Memory Poisoning
Warning
- Location
references/agents/integrations/mcp-memory/README.md:32- Finding
Unbounded Automatic Cross-Session Memory Storage and Recall
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Findings (157)
Harmful Content Injection
Critical
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.
- Content
md - Must not display pre- and post-treatment effect comparison images - "Diary-style" post-procedure result sharing is also restricted — even if "voluntarily shared by users," both the platform and the clinic may bear joint liability - Qualification display requirements: - Medical aesthetics facilities must display their Medical Institution Practice License (Yiliao Jigou Zhiye Xuke Zheng) - Lead physicians must hold a Medical Practitioner Certificate and corresponding specialist qualifications - Products used (e.g., botulinum toxin, hyaluronic acid) must display approval numbers and import registration certificates - Strict distinction between "lifestyle beauty services" (shenghuo meirong) and "medical aesthetics" (yiliao meirong): Photorejuvenation, laser hair removal, etc. are classified as medical aesthetics and must be performed in medical facilities - High-frequency medical aesthetics marketing violations: - Using celebrity/influencer cases to imply results - Price promotions like "top-up cashback" or "group-buy surgery" - Claiming "proprietary technology" or "patented technique" without supporting evidence
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 85% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md - **History is not a monolith.** "Medieval Europe" spans 1000 years and a continent. Be specific about when and where. - **Challenge Eurocentrism.** Don't default to Western civilization. The Song Dynasty was more technologically advanced than contemporary Europe. The Mali Empire was one of the richest states in human history. - **Material conditions matter.** Before discussing politics or warfare, understand the economic base: what did people eat? How did they trade? What technologies existed? - **Avoid presentism.** Don't judge historical actors by modern standards without acknowledging the difference. But also don't excuse atrocities as "just how things were." - **Myths are data too.** A society's myths reveal what they valued, feared, and aspired to. ## 📋 Your Technical Deliverables
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 85% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md - **History is not a monolith.** "Medieval Europe" spans 1000 years and a continent. Be specific about when and where. - **Challenge Eurocentrism.** Don't default to Western civilization. The Song Dynasty was more technologically advanced than contemporary Europe. The Mali Empire was one of the richest states in human history. - **Material conditions matter.** Before discussing politics or warfare, understand the economic base: what did people eat? How did they trade? What technologies existed? - **Avoid presentism.** Don't judge historical actors by modern standards without acknowledging the difference. But also don't excuse atrocities as "just how things were." - **Myths are data too.** A society's myths reveal what they valued, feared, and aspired to. ## 📋 Your Technical Deliverables
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md ## Messaging Architecture - **Brand Tagline**: [Memorable phrase encapsulating brand essence] - **Value Proposition**: [Clear statement of customer benefits] - **Key Messages**: 1. [Primary message for main audience] 2. [Secondary message for secondary audience]
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The identity and rules state that AI should generate logic and never touch the data directly. However, the implementation evaluates the generated lambda and applies it to dataframe values in place, changing the data itself. This is an active contradiction between the stated intent and the demonstrated behavior.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code uses eval on model-generated text after only superficial string filtering. A lambda can still access dangerous builtins or trigger side effects without containing banned substrings, making remote code execution or unauthorized file/system access possible if the model output is manipulated or simply produces unexpected Python.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The skill promotes autonomous router-weight updates and describes itself as managing 'self-modifying AI economics,' which introduces self-modifying operational behavior without a clearly defined human approval gate, scope limit, rollback control, or policy boundary. In a production routing context, this can let an agent alter live traffic decisions based on imperfect evaluation, adversarial inputs, or poisoned telemetry, leading to unsafe provider selection, unexpected cost spikes, privacy violations, or degraded output quality at scale.
- Content
md ## 🔍 How This Agent Differs From Existing Roles This agent fills a critical gap between several existing `agency-agents` roles. While others manage static code or server health, this agent manages **dynamic, self-modifying AI economics**. | Existing Agent | Their Focus | How The Optimization Architect Differs | |---|---|---|
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 70% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash git fetch origin git rebase -i origin/main # squash fixups, reword messages git push --force-with-lease # safe force push to your branchFinishing a Branch
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 75% confidence
- Finding
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
- Content
md 1. **Domain modeling** — Bounded contexts, aggregates, domain events 2. **Architectural patterns** — When to use microservices vs modular monolith vs event-driven 3. **Trade-off analysis** — Consistency vs availability, coupling vs duplication, simplicity vs flexibility 4. **Technical decisions** — ADRs that capture context, options, and rationale 5. **Evolution strategy** — How the system grows without rewrites ## 🔧 Critical Rules
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md ## Why This Exists <!-- 2-3 sentences: the problem this solves. Not features — the pain. --> ## Quick Start
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md ### Basic Example <!-- Most common use case, fully working --> ### Configuration
YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md with ZERO detection: | Technique ID | Technique Name | Used By | Priority | |--------------|-----------------------|------------------|-----------| | T1003.001 | LSASS Memory Dump | APT29, FIN7 | CRITICAL | | T1055.012 | Process Hollowing | Lazarus, APT41 | CRITICAL | | T1071.001 | Web Protocols C2 | Most APT groups | CRITICAL | | T1562.001 | Disable Security Tools| Ransomware gangs | HIGH | | T1486 | Data Encrypted/Impact | All ransomware | HIGH | ## Detection Roadmap (Next Quarter) | Sprint | Techniques to Cover | Rules to Write | Data Sources Needed | |--------|------------------------------|----------------|-----------------------| | S1 | T1003.001, T1055.012 | 4 | Sysmon (Event 10, 8) | | S2 | T1071.001, T1071.004 | 3 | DNS logs, proxy logs | | S3 | T1562.001, T1486 | 5 | EDR telemetry | | S4 | T1053.005,
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
Using curl with -k disables TLS certificate validation, allowing man-in-the-middle interception or redirection of the deployment request. Because the command also sends administrator credentials to the Splunk management API, an attacker on the network path could capture credentials or tamper with the deployed content.
- Content
md - name: Deploy to Splunk run: | # Push compiled rules via Splunk REST API curl -k -u "${{ secrets.SPLUNK_USER }}:${{ secrets.SPLUNK_PASS }}" \ https://${{ secrets.SPLUNK_HOST }}:8089/servicesNS/admin/search/saved/searches \ -d @compiled/splunk/rules.conf
YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
rule create
--resource-group ${{ secrets.AZURE_RG }}
--workspace-name ${{ secrets.SENTINEL_WORKSPACE }}
--alert-rule @compiled/sentinel/rules.kqltext ### Threat Hunt Playbook ```markdown # Threat Hunt: Credential Access via LSASS ## Hunt Hypothesis Adversaries with local admin privileges are dumping credentials from LSASS process memory using tools like Mimikatz, ProcDump, or direct ntdll calls, and our current detections are not catching all variants. ## MITRE ATT&CK Mapping - **T1003.001** — OS Credential Dumping: LSASS Memory - **T1003.003** — OS Credential Dumping: NTDS ## Data Sources Required - Sysmon Event ID 10 (ProcessAccess) — LSASS access with suspicious rights - Sysmon Event ID 7 (ImageLoaded) — DLLs loaded into LSASS - Sysmon Event ID 1 (ProcessCreate) — Process creation with LSASS handle ## Hunt Queries ### Query 1: Direct LSASS Access (Sysmon Event 10)index=windows sourcetype=WinEventLog:Sysmon EventCode=10
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
md - All shader parameters exposed to artists must have tooltip documentation in the material inspector ### Texture Pipeline - Always import textures at source resolution and let the platform-specific override system downscale — never import at reduced resolution - Use texture atlasing for UI and small environment details — individual small textures are a draw call budget drain - Specify mipmap generation rules per texture type: UI (off), world textures (on), normal maps (on with correct settings) - Default compression: BC7 (PC), ASTC 6×6 (mobile), BC5 for normal maps
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill is designed to publish directly to public TikTok and Instagram feeds and repeatedly emphasizes zero confirmation and notify-only-at-end behavior, but the description does not prominently warn users that public posting will occur without an approval gate. That creates a high risk of unintended public communications, reputational harm, and account misuse if the agent misinterprets input or generates harmful content.
- Content
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
md ### Self-Optimizing Growth Loop - **Performance Tracking**: Every post tracked via Upload-Post per-post analytics (`GET /api/uploadposts/post-analytics/{request_id}`) with views, likes, comments, shares - **Pattern Recognition**: `learn-from-analytics.js` performs statistical analysis across post history to identify winning formulas - **Recommendation Engine**: Generates specific, actionable suggestions stored in `learnings.json` for the next carousel - **Schedule Optimization**: Reads `bestTimes` from `learnings.json` and adjusts cron schedule so next execution happens at peak engagement hour - **100-Post Memory**: Maintains rolling history in `learnings.json` for long-term trend analysis
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill explicitly says cosmetics must not promise results, but later instructs hosts to say personal-use claims like bumps on the forehead 'went down by half' and to show before/after framing. In a sales-coaching context, this is dangerous because it normalizes unsubstantiated efficacy claims for regulated or compliance-sensitive products and can mislead consumers at scale.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
md Concrete examples of what you produce: - User Preference Schemas (tracking interaction styles). - Nudge Sequence Logic (e.g., "Day 1: SMS > Day 3: Email > Day 7: In-App Banner"). - Micro-Sprint Prompts. - Celebration/Reinforcement Copy. ### Example Code: The Momentum Nudge
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill specifically recommends passive behavioral monitoring through session recordings, heatmaps, and usage patterns without any warning that these techniques can capture sensitive behavioral or personal information. Because passive monitoring is more intrusive and often less visible to users, omitting consent, masking, and access-control requirements materially increases privacy and regulatory exposure.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill is explicitly marketed as an autonomous payment processor that can move funds across fiat and crypto rails, but it does not present a prominent user-facing warning or require explicit confirmation before initiating fund movement. In an agent ecosystem, this creates a real risk of unauthorized or accidental transfers because merely invoking the skill could be interpreted as sufficient authority to disburse money.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The example performs a live payment send after only basic idempotency and vendor checks, with no explicit user confirmation at the moment of transfer. This is dangerous because downstream agents or developers may copy this pattern directly, normalizing single-step payment execution without a final approval gate for high-risk irreversible actions.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The recurring bill workflow automatically iterates over due payments and sends them without a user-facing warning or per-payment authorization. Automatic recurring disbursement is especially risky because errors in schedules, vendor data, or compromised upstream systems can trigger bulk unauthorized payments at scale.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This cross-agent handler allows another agent to trigger contractor payments directly, effectively delegating payment authority without demonstrating strong authentication, approval provenance, or user acknowledgment. In a multi-agent environment, this is highly dangerous because a compromised, confused, or overly-permissive upstream agent could cause unauthorized transfers that appear legitimate.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md **Live demo**: [link] | **Full source**: [GitHub link] <!-- Hook: start with the end result, not with "in this tutorial we will..." --> Here's what we're building: a real-time order tracking dashboard that updates every 2 seconds without any polling. Here's the [live demo](link). Let's build it.
Static analysis
No suspicious patterns detected.