Security audit

context-management

Security checks for vulnerabilities and agentic risk

Overview

This context-management skill is coherent, but it can turn user and assistant conversation text into higher-priority system prompt context without sanitization or clear user control.

Review before installing. This skill does not appear to exfiltrate data or modify your machine, but it can preserve and elevate conversation content into system-level context. Avoid using it with secrets, credentials, private personal data, or untrusted user-supplied instructions unless you add redaction, provenance labels, and explicit approval for retained notes.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 84% confidence
Finding: The skill claims full lifecycle context management, but the described behavior includes extracting 'decisions/findings/issues/plans' from user/assistant messages and injecting them into the system prompt. That is a trust-boundary violation: untrusted conversational content can be elevated into higher-priority instructions or durable context, enabling prompt-injection persistence, policy contamination, or incorrect agent steering across later turns.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The conversation summarizer rewrites user and assistant content into a new system-role message, effectively upgrading untrusted conversational text into higher-priority context. That can amplify prompt-injection remnants, preserve sensitive user data beyond its original scope, and change future model behavior without any explicit boundary or disclosure. In a context-management skill, this is more dangerous because these transformed messages are intended to persist and steer later agent execution.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: StructuredNoteExtractor uses regex to copy selected user/assistant content into system prompt context, which promotes arbitrary matched text such as 'plan', 'decision', or 'important' into privileged instructions/memory. An attacker can intentionally phrase malicious content to match these patterns, causing prompt injection or policy-conflicting text to persist as system-level context across the conversation. Because this skill is specifically for long-lived context engineering, the persistence and authority boost make the issue especially risky.

Ssd 3

Medium

Confidence: 89% confidence
Finding: The summarizer copies the first 100 characters of old user messages and preserves them in a persistent summary, which can re-surface secrets, personal data, or sensitive requests after the original messages would otherwise have been dropped. This extends retention and visibility of sensitive content and can expose it to later model turns, tools, or downstream logging. In a context-compression module, that data-retention side effect is directly relevant and increases practical risk.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The note extractor promotes matched snippets from user and assistant messages into durable 'structured notes' inserted into prompt context, potentially retaining sensitive findings, errors, plans, or decisions long after the source messages are gone. Because extraction is pattern-based and broad, it may capture secrets or internal operational details and make them more persistent and more likely to influence later outputs. In an agent memory-management skill, persistent note creation materially increases exposure and propagation risk.

Static analysis

No suspicious patterns detected.