T09 · Insecure Skill Coding Practices
Error
- Location
scripts/synapse_client.py:52- Finding
Plaintext Memory Transmission Contradicts Client-Side Encryption and Zero-Knowledge Claims
- Content
View full analysis
- Remediation
View remediation
Security audit
Synapse Layer
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent remote memory integration, but it makes strong privacy/security claims that are contradicted by its client code and includes broad cross-agent memory access with weak disclosure.
Review before installing. Only use this skill when you intentionally want SynapseLayer to store or process agent memory remotely, avoid sending secrets or regulated personal data, do not rely on the zero-knowledge/client-side-encryption claims unless the publisher provides implementation evidence, restrict cross-agent search to authorized scopes, and avoid running the test script with production credentials or sensitive stored memories.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:17- Finding
Unpinned Third-Party Package Installation Creates Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/synapse_test.py:47- Finding
Test Script Exposes a Substantial API Key Prefix in Logs
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The frontmatter 'Use when' scope is very broad and includes generic memory, troubleshooting, and integration tasks, which can cause the orchestrator to invoke this skill in many contexts beyond narrowly intended SynapseLayer operations. Because this skill encourages use of an external persistence service and cross-agent memory handling, over-selection increases the chance that unrelated or sensitive agent data is routed to the skill unnecessarily.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The API reference explicitly documents storing arbitrary memory content and returning metadata about processing, but it provides no privacy, consent, retention, or sensitive-data handling warning. In a memory system, developers may send user secrets, preferences, or personal data by default, creating a real risk of unintended collection, over-retention, or disclosure if integrators assume the 'security pipeline' alone is sufficient.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation advertises cross-agent search and recall semantics without warning that these features can expose data outside a single agent boundary. In a multi-agent or multi-tenant environment, integrators may unknowingly enable broader data access patterns, increasing the chance of privacy leaks, context boundary violations, or accidental disclosure of another agent's stored memories.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The example explicitly stores a user preference in persistent memory, but the documentation gives no warning that this may retain personal data or create privacy obligations. In an integration guide, developers commonly copy-paste examples directly, so omission of consent, retention, and minimization guidance can lead to unintended collection and long-term storage of user data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The LangChain example stores a user message in chat history without clarifying that user-provided text may be retained in memory or logs. Because chat messages can contain sensitive information, this omission can cause downstream deployments to persist personal or confidential data without adequate disclosure or safeguards.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The document makes strong zero-knowledge and encrypted-operation claims without providing technical evidence, limitations, or references to implementation details. In a security-focused skill, unsupported assurances can mislead users into trusting the system with sensitive data under assumptions that may be false or only partially true, increasing the risk of inappropriate disclosure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The remember() method transmits caller-supplied memory content, tags, project, and agent identifiers to an external service at forge.synapselayer.org. In a memory/persistence client, this behavior is functionally expected, but the code provides no built-in consent, disclosure, redaction, or classification guardrails, which creates a real data exposure risk if sensitive prompts, secrets, or personal data are passed through.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The process_text() method sends arbitrary free-form text to a remote API for event extraction, which can include secrets, personal data, internal documents, or prompt contents. Because the text is unconstrained and the client adds no warnings, filtering, or redaction, this creates a meaningful confidentiality risk in agent environments where inputs may be highly sensitive.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Printing even a partial API key to stdout can disclose credential material into terminal history, logs, CI output, screenshots, or support artifacts. Partial secrets are often enough to aid key identification or correlation, and there is no operational need to display them during a basic test.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script performs remote write-like operations that store or process data without clearly warning the user that content will be transmitted to and persisted by an external service. Even though the sample data is benign, this pattern is risky in a reusable test script because operators may adapt it with real data and unintentionally create or retain records.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The recall test echoes stored memory content directly to output, which can reveal previously stored sensitive or personal information to local users, logs, and monitoring systems. A test helper should avoid displaying retrieved payloads unless explicitly necessary, because recall operations often surface real historical data.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script's stated purpose is a connectivity test, but it performs a cross-agent search across all agents, which expands scope beyond minimal validation and can access unrelated stored data. In a test context this is dangerous because it normalizes broad data access and may expose other agents' content during routine execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Cross-agent search can retrieve content belonging to other agents, but the script provides no warning that running this test may access broader stored data. In a testing or demo environment, that can surprise users and lead to unauthorized viewing of data outside the intended scope.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The cross-agent search results are printed in plaintext, creating a direct data exposure channel to anyone with access to the console, logs, CI artifacts, or captured output. Because the search spans all agents, the sensitivity is higher: unrelated users' stored content may be exposed during a simple test run.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The file asserts support for multiple compliance regimes, but the artifact provides no substantiation for those claims and even notes SOC 2 as planned, suggesting the list may mix current and aspirational status. Overstated compliance can cause operators or users to rely on regulatory protections that are not actually in place.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The search() method sends user queries and optional agent identifiers to a remote endpoint, which can disclose behavioral, operational, or tenant-scoping information to the third-party service. This is lower impact than raw memory upload because the payload is narrower, but it still represents external sharing without any disclosure or minimization controls in the client.
- Content
Static analysis
No suspicious patterns detected.