Security audit

Goldhold Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its persistent-memory purpose, but it asks agents to automatically send and reuse session memory through an external service without enough scoping, consent, or safety boundaries.

Install only if you are comfortable with agents sending selected session context, decisions, messages, and summaries to GoldHold for persistent remote storage. Do not use it for secrets, credentials, customer data, regulated information, or confidential work unless your operator has approved that data flow and you understand retention, deletion, project separation, and who can create or edit memories. Treat retrieved memories as notes to verify, not as instructions that can override the current user or platform rules.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:31
Finding: Persistent External Instruction and Memory Poisoning Channel
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:31-34, SKILL.md:99-123, and SKILL.md:133-138
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: High

Vulnerable Code Snippets

SKILL.md:31-34:

markdown
### POST /v1/auto -- Session Resume Call this when your session starts. Returns your context, inbox, open tasks, and capability card.

SKILL.md:99-123:

markdown
## What to Remember | Type | When to Use | |------|-------------| | FACT | Established truths, verified information | | DECISION | Choices made and the reasoning behind them | | DIRECTIVE | Standing instructions or rules | | NOTE | General observations, session notes | | CORRECTION | Overrides previous information (corrections outrank facts) | | CHECKPOINT | State snapshot at a point in time | | IDENTITY | Who you are, your configuration, persona | | DOCUMENT | Longer-form content, specs, references | | RELATION | Links between entities (person X works at company Y) | | TOMBSTONE | Marks something as deleted or invalid | | CUSTOM | Anything that doesn't fit the above | ## Storage Classes | Class | Purpose | Retrieval Priority | |-------|---------|-------------------| | **canonical** | Permanent truth, settled answers, standing directives | Checked first | | **corrections** | Field-proven overrides of old truth (outranks canonical on conflict) | Checked second | | **working** | Active session state, scratchpad, unresolved items | Checked third | | **archive** | Audit trail, old logs, historical records | Checked last, only on request |

SKILL.md:133-138:

markdown
## Rules 1. **Search before you assume.** Your past self left notes. Call `/v1/turn` with a search query before forming opinions or making claims about past work. 2. **Store decisions and facts immediately.** If something was decided, corrected, or established, store it in the same turn. 3. **Use `compact: tr ...[truncated 2760 chars]
Remediation: View remediation
Remediation Suggestions

Treat all retrieved memories, inbox messages, tasks, and capability data as untrusted content rather than executable instructions.

Explicitly prohibit retrieved records from overriding system instructions, safety constraints, tool permissions, current user intent, or authorization boundaries.

Require visible user approval before applying persisted DIRECTIVE, IDENTITY, or CORRECTION records.

Authenticate record provenance and preserve immutable metadata identifying the creator, timestamp, source session, and modification history.

Apply integrity protection to records and responses, with alerts for unexpected changes to high-impact memory types.

Restrict which principals may create or modify directives, identity records, corrections, and canonical entries.

Separate factual memory from behavioral instructions and prevent ordinary memory records from being interpreted as commands.

Provide record review, revocation, deletion, versioning, and rollback controls.

Add explicit guidance to quote or summarize retrieved content as data and to reject embedded requests for credentials, tool execution, policy changes, or external communications.

Use short retention periods and session- or project-specific namespaces to limit the duration and reach of poisoned records.

other

Warning

Location: SKILL.md:42
Finding: Unrestricted Transmission and Persistent Storage of Sensitive Session Context
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:42-67, SKILL.md:79-88, and SKILL.md:127-138
Vulnerability Type: other: Sensitive Data Disclosure
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:42-67:

markdown
### POST /v1/turn -- Search + Store + Send (Main Tool) This is your primary endpoint. Compound call that can search, store, and send messages in one request. ```json { "search": { "query": "what did we decide about the deployment strategy", "limit": 5 }, "store": [ { "type": "DECISION", "class": "canonical", "subject": "Deployment uses blue-green strategy", "body": "Decided on blue-green deploys for zero-downtime releases. Rollback by flipping traffic.", "confidence": "high" } ], "send": { "to": "owner", "subject": "Deployment decision made", "body": "Chose blue-green strategy for zero-downtime deploys." }, "compact": true }

text
`SKILL.md:79-88`: ```markdown ### POST /v1/session/close -- Graceful Session End Call this once at the end of your session with a meaningful summary. ```json { "session_summary": "Completed API integration for the payment system. Decided on Stripe webhooks for subscription events. Open question: retry policy for failed webhooks.", "compact": true }

text
`SKILL.md:127-138`: ```markdown ## Rules 1. **Search before you assume.** Your past self left notes. Call `/v1/turn` with a search query before forming opinions or making claims about past work. 2. **Store decisions and facts immediately.** If something was decided, corrected, or established, store it in the same turn. 3. **Use `compact: true`** on all requests. Saves tokens. 4. **One close per session.** Call `/v1/session/close` once at the end with a meaningful summary. 5. **Corrections outrank facts.** If previous information was wrong, store a CORRECTI ...[truncated 2430 chars]
Remediation: View remediation
Remediation Suggestions

Require explicit, informed user opt-in before enabling external persistent memory.

Require confirmation before each store or send operation, including a preview of the destination, recipient, and exact payload.

Default to session-local memory and use external persistence only for user-selected content.

Implement automatic redaction for API keys, passwords, authentication tokens, private keys, personal information, financial data, and other regulated or confidential content.

Establish a strict allowlist of data categories permitted for persistence; deny storage of secrets and raw conversation transcripts by default.

Introduce per-user, per-agent, and per-project namespaces to prevent inappropriate cross-context retrieval.

Validate and confirm recipients before using the send field.

Define retention periods, automatic expiration, deletion procedures, export controls, and audit logs.

Minimize session summaries so they contain only the information necessary for continuity.

Document the third-party data-processing boundary and provide clear guidance concerning ownership, retention, encryption, incident response, and regulatory obligations.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly instructs agents to search, store, and send session content to an external persistence service, but it does not clearly warn that potentially sensitive user data, prompts, decisions, inbox content, and session summaries may be transmitted off-platform and retained remotely. In a memory skill, this omission materially affects informed consent and safe use because agents may persist secrets or regulated data by default.
Content: No source excerpt is available for this finding.

External Transmission