T09 · Insecure Skill Coding Practices
Error
- Location
references/config-templates.md:211- Finding
Unredacted Conversation and Agent Configuration Data Is Backed Up to Cloud Destinations
- Content
View full analysis
- Remediation
View remediation
Security audit
backup
Security checks for vulnerabilities and agentic risk
Overview
The skill is openly about archiving and backing up sessions, but it would automatically retain full chat history, persistent memory, and agent configuration data and may sync them to GitHub or OneDrive without enough privacy controls.
Review carefully before installing. Only use this if you intentionally want long-term local and cloud retention of your conversations and agent configuration. Disable raw transcript backup unless needed, avoid storing secrets in chats, use private/encrypted backups, prefer SSH or a credential manager instead of token-in-URL Git remotes, and require manual review before MEMORY.md updates or cloud sync.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
references/troubleshooting.md:76- Finding
GitHub Access Token Is Embedded in the Git Remote URL
- Content
View full analysis
- Remediation
View remediation
T02 · Agent Memory Poisoning
Error
- Location
references/config-templates.md:14- Finding
Untrusted Conversation Content Can Be Promoted into Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (19)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill’s top-level description promotes automated archival and GitHub/OneDrive backup but does not clearly warn users that full conversation history may be stored and copied to external destinations. Because this workflow handles potentially sensitive chat content, missing upfront disclosure undermines informed consent and can cause accidental exfiltration of private data.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This section explicitly instructs persistent capture of raw conversation logs, structured summaries, long-term memory extraction, and cloud backup to GitHub/OneDrive. In a conversational system, chats often contain secrets, personal data, tokens, internal plans, or proprietary information, so automatic archival and external synchronization create a direct data leakage path.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The execution flow operationalizes the leak path by saving complete dialogue records, generating summaries, updating persistent memory, indexing metadata, and preparing backup state before reset. This makes data persistence automatic and recurring, increasing the chance that sensitive content is retained longer than intended and later exposed through local compromise, repo sync, or cloud backup.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The template says the agent should automatically archive, sync memory, and reset the session without user confirmation. That is unsafe because it changes retention state and persists conversation-derived data automatically, potentially capturing sensitive material the user did not agree to store or carry across sessions.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The template instructs automatic saving of raw conversation history, including timestamps, roles, content, and message IDs, with no explicit privacy warning or consent step. Raw transcripts are especially sensitive because they preserve full user content and metadata, increasing the harm from accidental exposure, later misuse, or external backup.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The instructions require automatic retention of full user conversation content across sessions, and the broader workflow includes backup to external destinations, all without user confirmation. This creates a serious privacy and data-governance issue because complete transcripts can contain secrets, personal data, or regulated information that should not be persistently stored by default.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The template describes automatic backups to GitHub and OneDrive without a clear up-front warning that conversation history and memory files may be transferred to third-party services. In this skill’s context, that substantially increases risk because private conversations, user profile data, and long-term memory can leave the local environment automatically and persist in external accounts.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The backup instructions explicitly direct copying conversation history and memory files to GitHub and OneDrive, which are third-party storage targets. Given the archived content includes raw history and long-term memory, this materially increases the exposure surface and can lead to persistent external disclosure of sensitive user data.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The document recommends embedding a GitHub token directly in the remote URL, which can leak credentials through shell history, process listings, config files, logs, screenshots, or accidental repository inspection. Because this skill manages automated backups, the token may have ongoing repository write access, making credential exposure especially dangerous.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill description and core user-facing instructions are written in Chinese and direct the interaction flow in that language, but there is no opt-in or note that the skill is intended only for Chinese-speaking users. This can violate language/locale policy when a skill implicitly forces a specific language without giving the user a choice.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The workflow defines automatic triggers for archival, file updates, backup marking, and reset behavior without a clear runtime warning that these actions can modify local files and initiate backup-related state changes when thresholds are reached. Users may not realize passive conditions like token or idle limits can cause persistence of conversation data and workflow state changes.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The template directs execution of external PowerShell scripts for summary generation and backup, which introduces code execution and trust-on-path risks outside the skill’s declared archive-management behavior. If those scripts are modified, replaced, or unsafe, the agent workflow could trigger unintended local actions or exfiltration of conversation data.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The template instructs the agent to extract decisions, to-dos, and important information from conversations and synchronize them into
MEMORY.mdfor future reuse. While framed as continuity, it still creates persistent storage of user-derived information across sessions, which is risky without clear consent, minimization, and controls over what categories of data may be retained.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The template explicitly instructs the agent to read complete session history via
sessions_historyor an internal API, which expands data access beyond ordinary file-based archive management into privileged retrieval of full conversation contents. In this skill’s context, that is dangerous because it enables broad collection of potentially sensitive user data for retention and later backup without clear consent boundaries.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill contains a concrete command to run a local backup PowerShell script from a fixed filesystem path, creating a direct execution primitive tied to local resources. In context, this is more dangerous because the script is part of a workflow that copies memory and conversation archives to external destinations, so compromise of the script or path could lead to unauthorized data transfer or broader system actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The guide instructs users to set PowerShell execution policy to RemoteSigned without any warning about the trust implications of allowing local and certain downloaded scripts to run. In this skill context, users are explicitly told to execute workspace scripts, so weakening execution safeguards can increase the chance of running tampered or malicious scripts from the same environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow explicitly stores complete raw conversation history and backs it up to GitHub and OneDrive, but provides no consent gate, data minimization, retention policy, or privacy warning. Because raw chat logs can contain credentials, personal data, proprietary content, and other sensitive context, automatic archival to third-party or cloud-backed locations materially increases the risk of privacy leakage and unauthorized disclosure.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
A skill document that effectively requires one language can create a locale-policy issue when no user choice or justification is provided. There is no statement that the guide is region-specific or that alternative language support is available.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The document describes automatic session reset and context cleanup triggered by token or idle thresholds without an explicit warning or confirmation flow. While not code execution, this can cause loss of active context, interrupt user work, and create unsafe assumptions that the archive fully preserved state before reset, especially in long-running or sensitive workflows.
- Content
Static analysis
No suspicious patterns detected.