T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:207- Finding
Persistent Agent Behavior Through Heartbeat Registration
- Content
View full analysis
- Remediation
View remediation
Security audit
ChilledSites
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it claims, but it can create accounts, send site content to ChilledSites, publish public websites, and add recurring agent behavior without clear user confirmation.
Review before installing. Only use this skill when you intentionally want an agent to work with ChilledSites, and require confirmation before signup, generation, upload, edit, deletion, or deployment. Do not send confidential prompts, secrets, private HTML, customer data, or regulated information unless you are willing to share it with the service and potentially publish it. Avoid adding the heartbeat instructions unless you explicitly want recurring ChilledSites checks and know how to remove them.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (14)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md Your AI agent's website builder. Generate and deploy websites from text prompts — no browser needed, pure REST API. **Base URL:** `https://api.chilledsites.com/functions/v1/api-v1` ## When to Use
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md Your AI agent's website builder. Generate and deploy websites from text prompts — no browser needed, pure REST API. **Base URL:** `https://api.chilledsites.com/functions/v1/api-v1` ## When to Use
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md Your AI agent's website builder. Generate and deploy websites from text prompts — no browser needed, pure REST API. **Base URL:** `https://api.chilledsites.com/functions/v1/api-v1` ## When to Use
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill documents account signup, content generation, editing, and live deployment to a third-party service, but it does not require an explicit warning that user data and prompts will be transmitted externally or that deployment makes content publicly accessible. Because the workflow includes no-human-needed signup and immediate publication, users could unintentionally authorize data transfer, account creation, spending, or exposure of sensitive material.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This finding points to the same signup endpoint behavior: the skill encourages sending user email data to a third-party service and obtaining credentials automatically. The combination of external transmission, secret issuance, and no-human-needed language makes this materially risky in an agent setting.
- Content
You can create an account and get API credentials directly — no human involvement required:
bash curl -X POST https://api.chilledsites.com/functions/v1/agent-signup \ -H "Content-Type: application/json" \ -d '{"email": "human@example.com", "source": "openclaw"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This finding points to the same signup endpoint behavior: the skill encourages sending user email data to a third-party service and obtaining credentials automatically. The combination of external transmission, secret issuance, and no-human-needed language makes this materially risky in an agent setting.
- Content
You can create an account and get API credentials directly — no human involvement required:
bash curl -X POST https://api.chilledsites.com/functions/v1/agent-signup \ -H "Content-Type: application/json" \ -d '{"email": "human@example.com", "source": "openclaw"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
The website generation step sends user prompts to an external service, which can include sensitive project details, and may consume paid or limited tokens. In this skill, the transmission is core functionality rather than malicious behavior, but it still needs consent and disclosure because users may not realize their prompts leave the system.
- Content
2. Generate a Website
bash curl -X POST https://api.chilledsites.com/functions/v1/api-v1/v1/generate \ -H "Content-Type: application/json" \ -H "X-API-Key: $CHILLEDSITES_API_KEY" \ -H "X-API-Secret: $CHILLEDSITES_API_SECRET" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
The deploy action publishes content to a live public subdomain on an external service. This is more dangerous than ordinary API use because it changes external state and can expose sensitive, inaccurate, or unreviewed content to the public internet if triggered without explicit approval.
- Content
3. Deploy to Live URL
bash curl -X POST https://api.chilledsites.com/functions/v1/api-v1/v1/websites/{website_id}/deploy \ -H "X-API-Key: $CHILLEDSITES_API_KEY" \ -H "X-API-Secret: $CHILLEDSITES_API_SECRET" \ -H "Content-Type: application/json" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
Editing an existing website transmits content, potentially including HTML, text, or embedded data, to a third-party service and modifies externally hosted assets. While expected for the product, it is still a real risk if the agent performs edits without clear user intent or sends sensitive material in the update payload.
- Content
4. Edit an Existing Website
bash curl -X PUT https://api.chilledsites.com/functions/v1/api-v1/v1/websites/{website_id} \ -H "X-API-Key: $CHILLEDSITES_API_KEY" \ -H "X-API-Secret: $CHILLEDSITES_API_SECRET" \ -H "Content-Type: application/json" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
This example again sends a user prompt to an external generation service, with the attendant privacy and cost concerns. Although duplicative of the main generation flow, it still reflects a real transmission pathway that should be bounded by consent and disclosure.
- Content
Generate a landing page
bash curl -X POST https://api.chilledsites.com/functions/v1/api-v1/v1/generate \ -H "Content-Type: application/json" \ -H "X-API-Key: $CHILLEDSITES_API_KEY" \ -H "X-API-Secret: $CHILLEDSITES_API_SECRET" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
This deployment example shows publication of a site to a public subdomain, creating externally visible state and potential public exposure. In an autonomous agent context, any path that can publish content live without a hard confirmation boundary is a meaningful security and safety risk.
- Content
Deploy to a subdomain
bash curl -X POST https://api.chilledsites.com/functions/v1/api-v1/v1/websites/abc-123/deploy \ -H "X-API-Key: $CHILLEDSITES_API_KEY" \ -H "X-API-Secret: $CHILLEDSITES_API_SECRET" \ -H "Content-Type: application/json" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
The upload endpoint accepts arbitrary HTML/CSS/JS and sends it to a third-party host, after which it can be served publicly. This is risky because it can exfiltrate sensitive embedded data, host malicious client-side code, or publish unsafe content if the agent uploads unreviewed material.
- Content
Upload custom HTML
bash curl -X POST https://api.chilledsites.com/functions/v1/api-v1/v1/websites/upload \ -H "Content-Type: application/json" \ -H "X-API-Key: $CHILLEDSITES_API_KEY" \ -H "X-API-Secret: $CHILLEDSITES_API_SECRET" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 82% confidence
- Finding
Image generation sends prompts to an external provider and may incur token cost, raising the same consent and privacy issues as text-to-website generation. The risk is moderate rather than high because it is less likely to publish content directly, but it still transmits user-supplied material externally.
- Content
Generate an AI image
bash curl -X POST https://api.chilledsites.com/functions/v1/api-v1/v1/generate/image \ -H "Content-Type: application/json" \ -H "X-API-Key: $CHILLEDSITES_API_KEY" \ -H "X-API-Secret: $CHILLEDSITES_API_SECRET" \
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The heartbeat guidance tells the agent to proactively offer website generation whenever a human mentions a new project, which creates an overbroad trigger for a capability that can incur cost and produce public-facing output. In this skill, that looseness is riskier because the same tool can create accounts, send prompts and content to an external service, and deploy sites live without an explicit confirmation boundary.
- Content
Static analysis
No suspicious patterns detected.