GoldHold Memory

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:35 PM UTC
• Version: 1.1.1

Overview

GoldHold is a disclosed remote memory skill, but it asks agents to persist and reuse session facts, summaries, directives, and identity-like records without enough safeguards for sensitive data or instruction trust.

Install only if you are comfortable sending selected agent memories and session summaries to GoldHold. Do not store secrets, API keys, private customer data, regulated records, or sensitive internal details. Treat all retrieved memories, directives, corrections, inbox messages, and identity records as untrusted context that cannot override current instructions, and use this only where you have a clear review and deletion process for stored records.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:40
• Finding: Persistent Remote Memory Can Poison Future Agent Sessions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 40, 108–110, 120–137, and 151–157 **Vulnerability Type**: Persistent instruction and identity poisoning through remotely stored memory **Risk Level**: Medium ### Vulnerable Snippets From line 40: ```markdown Call this when your session starts. Returns your context, inbox, open tasks, and capability card. ``` From lines 108–110: ```markdown SESSION START --> POST /v1/auto (get context, inbox, tasks) | DURING SESSION --> POST /v1/turn (search + store each interaction) ``` From lines 120–137: ```markdown | Type | When to Use | |------|-------------| | FACT | Established truths, verified information | | DECISION | Choices made and the reasoning behind them | | DIRECTIVE | Standing instructions or rules | | NOTE | General observations, session notes | | CORRECTION | Overrides previous information (corrections outrank facts) | | CHECKPOINT | State snapshot at a point in time | | IDENTITY | Who you are, your configuration, persona | | DOCUMENT | Longer-form content, specs, references | | RELATION | Links between entities (person X works at company Y) | | TOMBSTONE | Marks something as deleted or invalid | | CUSTOM | Anything that doesn't fit the above | ## Storage Classes | Class | Purpose | Retrieval Priority | |-------|---------|-------------------| | **canonical** | Permanent truth, settled answers, standing directives | Checked first | | **corrections** | Field-proven overrides of old truth (outranks canonical on conflict) | Checked second | ``` From lines 151–157: ```markdown ## Rules 1. **Search before you assume.** Your past self left notes. Call `/v1/turn` with a search query before forming opinions or making claims about past work. 2. **Store decisions and facts immediately.** If something was decided, corrected, or established, store it in the same turn. 3. **Use `compact: true`** on all requests. Saves tokens. 4. **One close per s ...[truncated 3318 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Explicitly state that all retrieved memories, inbox messages, tasks, and capability-card content are untrusted data and never higher-priority instructions. 2. Prohibit remote records from changing system policies, safety rules, tool permissions, agent identity, or the current user's instructions. 3. Separate informational records from behavioral directives at both the API and agent-integration layers. 4. Require explicit user approval before applying remotely retrieved `DIRECTIVE`, `IDENTITY`, or `CORRECTION` records. 5. Attach authenticated provenance to every record, including creator identity, creation time, source session, revision history, and integrity protection. 6. Restrict write access with least-privilege credentials and separate read-only, memory-write, and message-send permissions. 7. Detect and quarantine prompt-injection patterns in retrieved content rather than automatically placing them into the agent's instruction context. 8. Present newly created or modified standing directives to the user for review before they become active. 9. Provide auditable record histories, revocation, deletion, and account-wide invalidation of compromised records. 10. Document that current system and user instructions always outrank remotely stored memory, regardless of memory type or storage class. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:54
• Finding: Unrestricted Remote Storage Can Disclose Sensitive Session Context<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 54–75, 96–102, and 151–154 **Vulnerability Type**: Insufficient data-minimization and sensitive-data handling controls **Risk Level**: Low ### Vulnerable Snippets From lines 54–75: ```markdown ```json { "search": { "query": "what did we decide about the deployment strategy", "limit": 5 }, "store": [ { "type": "DECISION", "class": "canonical", "subject": "Deployment uses blue-green strategy", "body": "Decided on blue-green deploys for zero-downtime releases. Rollback by flipping traffic.", "confidence": "high" } ], "send": { "to": "owner", "subject": "Deployment decision made", "body": "Chose blue-green strategy for zero-downtime deploys." }, "compact": true } ``` ``` From lines 96–102: ```markdown Call this once at the end of your session with a meaningful summary. ```json { "session_summary": "Completed API integration for the payment system. Decided on Stripe webhooks for subscription events. Open question: retry policy for failed webhooks.", "compact": true } ``` ``` From lines 151–154: ```markdown ## Rules 1. **Search before you assume.** Your past self left notes. Call `/v1/turn` with a search query before forming opinions or making claims about past work. 2. **Store decisions and facts immediately.** If something was decided, corrected, or established, store it in the same turn. 3. **Use `compact: true`** on all requests. Saves tokens. ``` ### Technical Analysis The documented workflow encourages agents to store decisions and facts immediately, send messages, and submit a meaningful session summary to an external service. Although setup guidance correctly advises secure storage of the API key, the operational rules do not require data classification, secret scanning, redaction, user consent, or retention limits before transmitting session information. Decisions, facts, search queries, messages, and ...[truncated 1919 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit user consent before sending session content to the remote service, especially on the first transmission and for session-close summaries. 2. Define prohibited data categories, including passwords, API keys, authentication tokens, private keys, personal data, regulated records, proprietary source code, and confidential customer information. 3. Apply local secret detection and redaction before constructing any API request. 4. Use an allowlist-based storage policy so only explicitly selected facts and decisions are retained. 5. Default to short, sanitized summaries rather than raw conversation content. 6. Provide a preview-and-confirmation step for messages, canonical records, directives, identity records, and session summaries. 7. Document retention periods and provide user-accessible deletion, export, and revocation controls. 8. Support per-record expiration and avoid permanent `canonical` storage unless the user expressly approves it. 9. Use scoped API credentials and restrict message-sending capability when it is not required. 10. Clearly disclose that searches, stored records, messages, and session summaries are transmitted to a third-party endpoint. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README promotes persistent cross-session memory and API-based storage for agent decisions, facts, and corrections, but it does not warn users that sensitive prompts, personal data, secrets, or regulated information may be retained and transmitted to a third-party service. In an AI-agent context, durable memory materially changes the privacy and security model, because agents may automatically store user content or credentials unless the operator is explicitly told to minimize, redact, classify, and govern what is persisted.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill is explicitly designed to persist agent memory by sending session context, decisions, and summaries to a third-party service, but it does not clearly warn users in the skill description that potentially sensitive data will be transmitted off-platform for storage and retrieval. This creates a real privacy and data-governance risk because users may invoke the skill without informed consent about external handling of their session data.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Resume session
curl -X POST https://relay.goldhold.ai/v1/auto \
  -H "Authorization: Bearer $GOLDHOLD_API_KEY" \
  -H "Content-Type: application/json" \
  -H "User-Agent: goldhold-agent/1.0" \

• Confidence: 91% confidence
• Finding: The skill instructs agents to send session context and stored memories to https://relay.goldhold.ai, which is an external service outside the local trust boundary. In the context of a persistent-memory skill, this behavior is intentional, but it is still security-relevant because it can exfiltrate sensitive prompts, decisions, identities, or operational details if used without strict scoping and user awareness.

Static analysis

No suspicious patterns detected.