Security audit

Session Relay

Security checks for vulnerabilities and agentic risk

Overview

This skill is built for session continuity, but it automatically and silently reads, stores, and reuses prior conversation text across sessions in ways users may not expect.

Review before installing. This skill may improve continuity, but it should only be used where automatic reuse of recent session text is acceptable. Prefer an opt-in restore flow, summary-only snapshots, clear file retention rules, and a way to inspect or delete stored memory before enabling it in sensitive or shared workspaces.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:20
Finding: Automatic Cross-Session Collection and Persistent Storage of Conversation Data
Content: View full analysis
", limit: 15, includeTools: false) **Focus on the last ~10 user/assistant exchanges per session.** Skip tool calls — you want the actual conversation flow. ### Step 3: Save raw conversation tails to snapshot Write the **verbatim last 3 rounds** (user message + assistant reply = 1 round) from each session into the snapshot file. **Rules:** - Store **verbatim conversation text**, not summaries — summaries lose the "feel" - 3 rounds per session max (6 messages) — enough for context, not too much for token budget - If sessions are very old (> 24h), still store but note the time gap - If the user's first message already states what they want, weave context in naturally - **Never block the user** — if `sessions_list`/`sessions_history` fails, proceed normally - **Security**: Strip any API keys/tokens that appear in conversation before saving ``` ### Technical Analysis The Skill automatically enumerates recent main sessions, reads conversation history from as many as three previous sessions, and writes verbatim messages into `memory/relay-snapshot.md`. This occurs on every new session without requiring user confirmation or verifying that the retrieved sessions belong to the same user, task, workspace, or security context. Filtering by session kind (`main`) is not an identity or authorizat ...[truncated 2348 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:35
Finding: Persistent Prompt Injection Through Verbatim Conversation Restoration
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared description presents a broad automatic session continuity system with trigger conditions, state preservation, history retrieval, and handoff behavior. The supplied code only performs a narrow file-management action: if a specific snapshot file exists, it copies it to an archive folder with a timestamp and deletes the original. While archiving a snapshot could be a supporting part of state preservation, this code does not implement the core described behaviors, and its primary purpose is materially narrower than the declared functionality.
Content: No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: session-relay description: "Automatic session continuity and task handoff across context window boundaries. Use when: (1) context token usage exceeds 70% of the model's context window, (2) user starts a new session after a long conversation, (3) agent needs to preserve ongoing task state before compaction or session reset, (4) user says 'continue from last session' or 'what were we working on'. Monitors context usage, auto-saves rich task snapshots, pulls recent session history, and ensures seamless task inheritance when a new session begins." --- # Session Relay 🏃‍♂️ Seamless session continuity

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to fetch recent sessions and store verbatim conversation tails across sessions without any explicit user consent or prominent privacy notice. Even with a note to strip API keys, verbatim text can still contain sensitive personal, business, or security-relevant information that gets retained and surfaced later.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Persisting verbatim user conversation across sessions creates a durable natural-language data retention channel. That channel can capture secrets, confidential plans, personal data, or prior instructions, and later expose them to other prompts, users, or sessions in ways the original user did not expect.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill tells the agent to naturally reference and act on prior conversation content in later sessions, which increases the risk of unintended disclosure or cross-context leakage. This is especially dangerous when the new session starts with a different audience, a changed scope, or ambiguous user identity, because sensitive past details may be surfaced without validation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill describes automatic writes to snapshot, archive, heartbeat, and daily log files, but does not clearly disclose those filesystem side effects to the user at the time they occur. Silent persistence increases the chance that sensitive task details are left on disk where other tools, users, or later sessions may access them unexpectedly.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The restore workflow explicitly instructs the agent to silently recover prior-session data and continue as if it remembers, without telling the user. Hidden context restoration can bypass user expectations, expose retained sensitive information, and make it impossible for users to meaningfully consent to or correct what historical data is being brought forward.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This shell script performs a destructive operation by removing the original snapshot after copying it to the archive. While the final echo reports the archive destination, there is no prior confirmation prompt or explicit warning in the script comments that running it will delete the source file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The critical alert section mandates appending a fixed Chinese-language warning to every reply once context exceeds 85%. This imposes a specific language without user opt-in or documented locale justification, which is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.