T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:90- Finding
Unbounded Plaintext Persistence of Potentially Sensitive Conversation Data
- Content
View full analysis
- Remediation
View remediation
Security audit
Context Guardian
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent session-memory helper, but it broadly and quietly saves and reloads conversation history across sessions in plaintext.
Review this carefully before installing in sensitive workspaces. It does not show code execution, exfiltration, or destructive behavior, but it is intended to save and reload local conversation notes automatically. Avoid using it where chats may include secrets, personal data, confidential business details, or instructions from untrusted sources unless you add explicit consent, redaction, review, and deletion practices.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:217- Finding
Persistent Cross-Session Memory Poisoning Through Automatically Reloaded Notes
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill says to 'Use this skill ALWAYS' and defines broad passive triggers, effectively making it run in nearly every session. A passively invoked skill with authority to read and write notes expands its reach across unrelated conversations and increases the chance of unauthorized persistence or context leakage.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill tells the agent to save important information and manage files for the user without prominently warning that conversation content and preferences may be persisted across sessions. Silent persistence of personal or sensitive details creates privacy and consent risks, especially because the skill is meant to run passively.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This section directs the agent to write decisions, preferences, outcomes, action items, and rationale to daily files 'as they happen,' often silently. Persisting broad user-provided data without explicit approval or data minimization can capture sensitive personal or business context and make later misuse or accidental exposure more damaging.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill is described as passive context-quality management, but its behavior expands into persistent memory management, archival workflows, and long-term state curation. That mismatch can cause users and orchestrators to underestimate the amount of retention and data handling the skill performs.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to proactively read today's and yesterday's notes at the start of every session, plus review recent notes for pruning. That grants routine cross-session file access unrelated to a narrowly scoped context-health check and can expose prior sensitive conversation data without an explicit user request in the current session.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The startup workflow tells the agent to silently read prior notes from earlier sessions to recover context. That creates implicit cross-session memory access, which can surface stale or sensitive information into a new conversation without the user's immediate awareness or need.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The end-of-session workflow instructs the agent to save comprehensive records of everything discussed, including decisions, reasoning, action items, user preferences, and next steps. Comprehensive default logging maximizes privacy risk and creates an unnecessary corpus of sensitive history, especially for a skill that is designed to run in all sessions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The guide normalizes automatic reading and writing of workspace memory files across sessions without clearly warning users that conversation content, preferences, and project details may be persisted locally and later reloaded. In a passive, always-on skill focused on session memory, this increases the chance of unintentionally storing sensitive information or reintroducing stale/private context without informed user consent.
- Content