Security audit

Hizal End

Security checks for vulnerabilities and agentic risk

Overview

This session wrap-up skill is not deceptive, but it can automatically write or delete persistent project memory after broad end-of-task cues.

Install only if you want the agent to perform end-of-session memory consolidation. Review promoted chunks carefully, avoid promoting content from untrusted files or conversations, and require explicit approval before project memory writes or source-context deletion.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:3
Finding: Unvalidated Promotion of Surfaced Context into Persistent Project Memory
Content: View full analysis
", query_key="", title="", content="<chunk-content>") # For codebase conventions hizal__write_convention(project_id="<id>", query_key="<key>", title="<title>", content="<chunk-content>") ``` Then optionally delete the original AGENT chunk: ```text hizal__delete_context(project_id="<id>", id="<chunk-id>") ``` ``` ### Technical Analysis The skill self-triggers on broad task-completion conditions and instructs the agent to promote surfaced context chunks into persistent project knowledge or conventions. It does not require explicit user confirmation, provenance validation, sanitization, or a check that the chunk contains only factual project knowledge rather than instructions originating from untrusted task content. Consequently, misleading information or instruction-like content introduced during a task could be selected for promotion and remain available to future sessions. The optional deletion of the original agent-context chunk can reduce provenance and make subsequent review more difficult. This issue is limited to the behavior described by the skill instructions. The audited project contains no scripts, dep ...[truncated 1514 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is explicitly self-triggering on common wrap-up phrases like "I'm done" and "that's it for now," which are likely to occur in ordinary conversation outside a tightly scoped invocation context. That can cause the skill to fire unintentionally, ending sessions and initiating memory consolidation actions at inappropriate times, potentially disrupting workflow or causing unintended promotion/deletion decisions.
Content: No source excerpt is available for this finding.