Security audit

Hizal Write

Security checks for vulnerabilities and agentic risk

Overview

This memory-writing skill is disclosed, but it pushes broad persistent writes and auto-injected memory without clear user control or sensitivity limits.

Install only if you explicitly want agents to write durable Hizal memory during work. Before use, constrain it to approved scopes, require confirmation for PROJECT or ORG writes, avoid identity/personality writes unless deliberately requested, and do not store secrets, credentials, personal data, raw conversation content, or unverified claims.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:2
Finding: Mandatory Continuous Writes Can Poison Persistent Agent Memory
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:2
Finding: Skill Instructions Override Agent Discretion and Permit Persistent Identity Manipulation
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:15
Finding: Unrestricted Cross-Scope Writes Violate Least-Privilege Boundaries
Content: View full analysis
", query_key="", title="", content="", scope="PROJECT", # or AGENT, ORG project_id="", # required for PROJECT scope org_id="", # required for ORG scope agent_id="" # required for AGENT scope ) ``` ```markdown ## Common Fields All write tools accept: - **query_key** — unique key for this topic (enables exact lookup later) - **title** — short descriptive title - **content** — the full context content - **source_file** / **source_lines** — where this came from - **gotchas** — list of warnings or pitfalls - **related** — list of related query_keys - **inject_audience** — DNF targeting spec for auto-injection (omit for defaults) ``` ### Technical Analysis The skill directs the agent to write across AGENT, PROJECT, and ORG scopes and supports audience-targeted automatic injection. It does not define authorization checks, scope-selection restrictions, tenant isolation requirements, or approval gates for broad writes. A normal task generally does not require permission to modify organization-wide knowledge or content delivered to other audiences. Allowing untrusted session-derived content to be promo ...[truncated 1492 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill is explicitly self-triggering on very broad phrases and on nearly any moment the agent 'learns something,' which can cause the skill to activate in many unrelated contexts. That creates a high risk of unintended persistence actions, including storing transient reasoning, user content, or sensitive project details without deliberate operator intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill mandates persistent writes and includes deletion capability, but it does not warn about retention, data sensitivity, or the consequences of modifying persistent memory stores. In practice, this can cause agents to write or delete durable knowledge without informed consent, review, or safeguards, increasing the chance of privacy, integrity, and governance failures.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The instruction to 'persist what the agent learns' continuously and 'not optional' strongly encourages indiscriminate storage of conversational and operational data. In a memory-writing skill, that context makes the issue more dangerous because the natural effect is to capture user-provided details, internal decisions, and potentially sensitive data far beyond minimally necessary knowledge.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guidance to write one chunk per decision and to include the 'full context content' encourages high-frequency persistence of rich natural-language data. That pattern materially increases the chance that sensitive user inputs, internal reasoning artifacts, credentials, tokens, or confidential project details are copied into long-lived storage where they may later be injected or retrieved inappropriately.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: L22 says not to use hizal__write_context because it is deprecated and to use purpose-built tools instead, but the later promotion instructions rely on the older generic context API family: hizal__read_context and hizal__delete_context at L97-L99. This creates intent-level inconsistency in the documentation about whether deprecated context-style tooling should be used.
Content: No source excerpt is available for this finding.