Goldhold Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:15 AM UTC
• Version: 1.5.0

Overview

This skill matches its persistent-memory purpose, but it asks agents to automatically send and reuse session memory through an external service without enough scoping, consent, or safety boundaries.

Install only if you are comfortable with agents sending selected session context, decisions, messages, and summaries to GoldHold for persistent remote storage. Do not use it for secrets, credentials, customer data, regulated information, or confidential work unless your operator has approved that data flow and you understand retention, deletion, project separation, and who can create or edit memories. Treat retrieved memories as notes to verify, not as instructions that can override the current user or platform rules.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:31
• Finding: Persistent External Instruction and Memory Poisoning Channel## Vulnerability Details **File Location**: `SKILL.md:31-34`, `SKILL.md:99-123`, and `SKILL.md:133-138` **Vulnerability Type**: `T02: Agent Memory Poisoning` **Risk Level**: High ### Vulnerable Code Snippets `SKILL.md:31-34`: ```markdown ### POST /v1/auto -- Session Resume Call this when your session starts. Returns your context, inbox, open tasks, and capability card. ``` `SKILL.md:99-123`: ```markdown ## What to Remember | Type | When to Use | |------|-------------| | FACT | Established truths, verified information | | DECISION | Choices made and the reasoning behind them | | DIRECTIVE | Standing instructions or rules | | NOTE | General observations, session notes | | CORRECTION | Overrides previous information (corrections outrank facts) | | CHECKPOINT | State snapshot at a point in time | | IDENTITY | Who you are, your configuration, persona | | DOCUMENT | Longer-form content, specs, references | | RELATION | Links between entities (person X works at company Y) | | TOMBSTONE | Marks something as deleted or invalid | | CUSTOM | Anything that doesn't fit the above | ## Storage Classes | Class | Purpose | Retrieval Priority | |-------|---------|-------------------| | **canonical** | Permanent truth, settled answers, standing directives | Checked first | | **corrections** | Field-proven overrides of old truth (outranks canonical on conflict) | Checked second | | **working** | Active session state, scratchpad, unresolved items | Checked third | | **archive** | Audit trail, old logs, historical records | Checked last, only on request | ``` `SKILL.md:133-138`: ```markdown ## Rules 1. **Search before you assume.** Your past self left notes. Call `/v1/turn` with a search query before forming opinions or making claims about past work. 2. **Store decisions and facts immediately.** If something was decided, corrected, or established, store it in the same turn. 3. **Use `compact: tr ...[truncated 2760 chars]
• Remediation: ## Remediation Suggestions 1. Treat all retrieved memories, inbox messages, tasks, and capability data as untrusted content rather than executable instructions. 2. Explicitly prohibit retrieved records from overriding system instructions, safety constraints, tool permissions, current user intent, or authorization boundaries. 3. Require visible user approval before applying persisted `DIRECTIVE`, `IDENTITY`, or `CORRECTION` records. 4. Authenticate record provenance and preserve immutable metadata identifying the creator, timestamp, source session, and modification history. 5. Apply integrity protection to records and responses, with alerts for unexpected changes to high-impact memory types. 6. Restrict which principals may create or modify directives, identity records, corrections, and canonical entries. 7. Separate factual memory from behavioral instructions and prevent ordinary memory records from being interpreted as commands. 8. Provide record review, revocation, deletion, versioning, and rollback controls. 9. Add explicit guidance to quote or summarize retrieved content as data and to reject embedded requests for credentials, tool execution, policy changes, or external communications. 10. Use short retention periods and session- or project-specific namespaces to limit the duration and reach of poisoned records.

other

Warning

• Location: SKILL.md:42
• Finding: Unrestricted Transmission and Persistent Storage of Sensitive Session Context## Vulnerability Details **File Location**: `SKILL.md:42-67`, `SKILL.md:79-88`, and `SKILL.md:127-138` **Vulnerability Type**: `other: Sensitive Data Disclosure` **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:42-67`: ```markdown ### POST /v1/turn -- Search + Store + Send (Main Tool) This is your primary endpoint. Compound call that can search, store, and send messages in one request. ```json { "search": { "query": "what did we decide about the deployment strategy", "limit": 5 }, "store": [ { "type": "DECISION", "class": "canonical", "subject": "Deployment uses blue-green strategy", "body": "Decided on blue-green deploys for zero-downtime releases. Rollback by flipping traffic.", "confidence": "high" } ], "send": { "to": "owner", "subject": "Deployment decision made", "body": "Chose blue-green strategy for zero-downtime deploys." }, "compact": true } ``` ``` `SKILL.md:79-88`: ```markdown ### POST /v1/session/close -- Graceful Session End Call this once at the end of your session with a meaningful summary. ```json { "session_summary": "Completed API integration for the payment system. Decided on Stripe webhooks for subscription events. Open question: retry policy for failed webhooks.", "compact": true } ``` ``` `SKILL.md:127-138`: ```markdown ## Rules 1. **Search before you assume.** Your past self left notes. Call `/v1/turn` with a search query before forming opinions or making claims about past work. 2. **Store decisions and facts immediately.** If something was decided, corrected, or established, store it in the same turn. 3. **Use `compact: true`** on all requests. Saves tokens. 4. **One close per session.** Call `/v1/session/close` once at the end with a meaningful summary. 5. **Corrections outrank facts.** If previous information was wrong, store a CORRECTI ...[truncated 2430 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit, informed user opt-in before enabling external persistent memory. 2. Require confirmation before each store or send operation, including a preview of the destination, recipient, and exact payload. 3. Default to session-local memory and use external persistence only for user-selected content. 4. Implement automatic redaction for API keys, passwords, authentication tokens, private keys, personal information, financial data, and other regulated or confidential content. 5. Establish a strict allowlist of data categories permitted for persistence; deny storage of secrets and raw conversation transcripts by default. 6. Introduce per-user, per-agent, and per-project namespaces to prevent inappropriate cross-context retrieval. 7. Validate and confirm recipients before using the `send` field. 8. Define retention periods, automatic expiration, deletion procedures, export controls, and audit logs. 9. Minimize session summaries so they contain only the information necessary for continuity. 10. Document the third-party data-processing boundary and provide clear guidance concerning ownership, retention, encryption, incident response, and regulatory obligations.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly instructs agents to search, store, and send session content to an external persistence service, but it does not clearly warn that potentially sensitive user data, prompts, decisions, inbox content, and session summaries may be transmitted off-platform and retained remotely. In a memory skill, this omission materially affects informed consent and safe use because agents may persist secrets or regulated data by default.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Resume session
curl -X POST https://relay.goldhold.ai/v1/auto \
  -H "Authorization: Bearer $GOLDHOLD_API_KEY" \
  -H "Content-Type: application/json" \
  -H "User-Agent: goldhold-agent/1.0" \

• Confidence: 94% confidence
• Finding: The demonstrated curl commands and endpoint guidance direct the agent to transmit session context and memory content to https://relay.goldhold.ai, which is an external service. In the context of a persistent memory skill, this creates a real data exfiltration/privacy risk if the agent stores sensitive prompts, summaries, inbox messages, decisions, or secrets without strong minimization and user authorization.

Static analysis

No suspicious patterns detected.