Async & Concurrency Reviewer

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:05 PM UTC
• Version: 1.0.0

Overview

This is a normal async-code review skill, but it asks the agent to retain and reuse patterns from prior reviews without clear consent, scope, or deletion controls.

Install only if you are comfortable with the agent keeping review-derived pattern statistics across uses, or ensure your runtime treats that instruction as session-local and does not store private code, identifiers, filenames, or free-form findings. The code-review checklist itself is ordinary and no executable or network behavior was found.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:97

Finding

Cross-Session Review Tracking May Poison Persistent Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 97–99
Vulnerability Type: Persistent state manipulation
Risk Level: Medium

Vulnerable Code

markdown

## Self-improvement instructions
After each review, note the most common finding. After 20 reviews, surface the top 3 patterns in your response as "Most common issues in [language]" to help users learn, not just fix.

Technical Analysis

The Skill directs the Agent to record findings after every review and reuse aggregated information after 20 reviews. Fulfilling this instruction across independent invocations requires persistent or long-term state, although persistent data collection is not part of the declared single-review input and output contract.

The instruction does not define user consent, tenant isolation, data minimization, retention limits, deletion procedures, or whether recorded findings may contain information derived from private source code. Consequently, review-derived state from one project or user could influence responses delivered in a later, unrelated context.

This is classified as agent memory poisoning because Skill-controlled instructions direct the Agent to write and later surface persistent state. The file contains no mechanism for external exfiltration, executable persistence, or operating-system privilege escalation.

Attack Path

1. A user loads the Skill and submits asynchronous or concurrency-related source code for review.
2. The Agent follows the self-improvement instruction and records the most common finding from that review.
3. The Agent repeats this process across subsequent reviews, potentially spanning separate projects, users, or sessions.
4. After 20 reviews, the Agent retrieves and inserts the accumulated top-three patterns into a later response.
5. If state is not strictly isolated, historical information or attacker-influenced patterns can affect an unrelated user's output.

Impact Assessment

The issue does not directly ...[truncated 556 chars]

Remediation

View remediation

Remediation Suggestions

Remove the cross-review tracking instruction unless persistent analytics are an explicit, necessary, and user-approved feature.

If review statistics are retained, apply all of the following controls:

1. Require explicit opt-in consent before storing any review-derived information.
2. Keep statistics session-local by default and discard them when the review ends.
3. Isolate retained state by authenticated user and project; never aggregate across tenants.
4. Store only predefined, anonymized category counters rather than source code, excerpts, filenames, identifiers, or free-form findings.
5. Define clear retention limits and provide inspection, reset, and deletion controls.
6. Prevent stored statistics from becoming instructions or overriding the current user's task.
7. Document the behavior in the Skill description and output contract.
8. Prefer computing educational summaries only from the current review without persistent storage.

A safe replacement would be:

markdown

For the current review only, summarize up to three recurring issue categories found in the submitted code. Do not retain review content or statistics after the response is generated.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The listed invocations include generic phrases like "review my async code," "check my concurrency," and a catch-all condition for "Any code with" common primitives. In a markdown skill description, this is broad enough to match many ordinary development requests without clear boundaries or exclusion conditions, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instruction to track the most common findings across reviews implies retention and aggregation of prior users' submitted code-review content over time. In a code-review skill, user inputs may contain proprietary source code, secrets, internal architecture, or customer data, so cross-session memory or later surfaced aggregates can leak sensitive information or create unauthorized data reuse.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.