Hizal Search

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:47 AM UTC
• Version: 0.1.0

Overview

The skill is a transparent Hizal context-search helper, but it is broad enough to trigger often, read unscoped prior agent memory, and recommend persistent knowledge writes without clear approval gates.

Review this before installing if your Hizal store contains private, cross-project, or historical agent notes. Prefer installing only where AGENT and ORG searches are access-controlled, and treat any write-back to knowledge or conventions as a separately approved action.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:27
• Finding: Broad, Unscoped Access to Prior Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 27-29 **Vulnerability Type**: Unauthorized access to historical Agent memory **Risk Level**: Medium ### Vulnerable Code ```text # Prior agent memory / investigation notes hizal__search_context(query="<concept>", scope="AGENT", chunk_type="MEMORY") ``` ### Technical Analysis The Skill instructs the Agent to search prior Agent memory and investigation notes without requiring a project restriction, session boundary, user authorization, relevance check, or sensitive-data filtering. This access pattern exceeds ordinary source-code search and may retrieve historical context unrelated to the current task. Because the query is based only on a general concept, broadly phrased searches could cause the Hizal service to return confidential or sensitive information from previous investigations. The retrieved content could then enter the current Agent context and affect its reasoning or appear in generated output. ### Attack Path 1. A task or untrusted prompt causes the Skill to activate for a broadly defined concept. 2. The Agent invokes `hizal__search_context` with `scope="AGENT"` and `chunk_type="MEMORY"`. 3. The search returns prior Agent memories or investigation notes that are not restricted to the current project or session. 4. Sensitive historical content enters the active context. 5. The content may be disclosed in a response or improperly used to influence current work. ### Impact Assessment Successful exploitation could expose historical Agent notes, prior investigation details, internal decisions, or other sensitive context accessible through the Agent-memory scope. The affected scope depends on the access controls implemented by the Hizal service. The Skill itself does not establish a privilege boundary or request additional system permissions, but it encourages access beyond the minimum context needed for a typical code-search task. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Require explicit user approval before searching prior Agent memory. - Restrict memory searches to the current project, session, or another authorized tenant boundary. - Require a specific purpose and narrowly scoped query rather than broad conceptual searches. - Apply least-result limits and exclude unrelated records. - Redact credentials, personal information, and other sensitive data before returned chunks enter the Agent context. - Enforce authorization in the Hizal service rather than relying solely on Skill instructions. - Record memory access in an audit log that identifies the requester, scope, query, and returned record identifiers. ]]>

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:75
• Finding: Unvalidated Promotion of Agent Memory into Persistent Knowledge<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 75-77 **Vulnerability Type**: Persistent Agent memory poisoning **Risk Level**: High ### Vulnerable Code ```text 5. **If an AGENT memory chunk is broadly useful** — promote it with `write_knowledge` or `write_convention` See `hizal-write` skill for writing back to Hizal. ``` ### Technical Analysis Although the Skill primarily describes search and read operations, it recommends promoting Agent-memory content into persistent knowledge or conventions. The instruction does not require provenance verification, validation of the retrieved content, explicit approval, conflict detection, or protection against untrusted text. An attacker-controlled or inaccurate memory chunk could therefore be judged “broadly useful” and written into a durable knowledge store. If future Agents treat stored knowledge or conventions as trusted guidance, the poisoned content can continue influencing later sessions and tasks. ### Attack Path 1. An attacker or an earlier compromised interaction introduces misleading instructions or false information into an Agent-memory chunk. 2. The current Agent searches the `AGENT` memory scope and retrieves that chunk. 3. The Agent interprets the content as broadly useful. 4. Following the Skill’s recommendation, the Agent invokes `write_knowledge` or `write_convention` through the referenced write workflow. 5. The unvalidated content becomes persistent knowledge or a convention. 6. Future Agents retrieve and trust the poisoned record, allowing its influence to persist across sessions. ### Impact Assessment The issue can affect future Agent sessions and any users or projects permitted to consume the resulting knowledge or convention. Potential consequences include persistent behavioral manipulation, propagation of incorrect architectural guidance, repeated unsafe actions, and contamination of shared organizational knowledge. The exact scope depends on the permissions and sco ...[truncated 41 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove persistent-write recommendations from this search-focused Skill, or clearly separate read and write capabilities. - Require explicit user or authorized reviewer approval before promoting memory to persistent knowledge. - Verify the provenance, ownership, project scope, and integrity of every source chunk. - Treat retrieved memory as untrusted input and reject embedded instructions that attempt to alter Agent behavior. - Validate promoted content against authoritative project sources and existing conventions. - Use narrowly scoped write permissions; do not allow automatic organization-wide promotion. - Preserve source references and record who approved and performed each promotion. - Add versioning, review status, expiration, and rollback mechanisms for promoted records. - Scan proposed persistent content for secrets, personal data, and prompt-injection instructions before writing it. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The skill is configured to self-trigger on extremely broad, common phrases such as 'let me check', 'find', 'recall', and on any moment the agent might gather background knowledge. This can cause the skill to activate in many unrelated contexts, potentially hijacking agent behavior, creating excessive tool use, and routing sensitive queries into Hizal even when not necessary.

Static analysis

No suspicious patterns detected.