AgentBase

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:23 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent shared-memory integration, but it encourages broad proactive storage to a public-by-default external knowledge service without enough user control or sensitivity limits.

Install only if you are comfortable with agents sending selected knowledge to an external shared service. Do not store secrets, credentials, private conversation content, proprietary code, personal data, or regulated information, and prefer private visibility unless you intentionally want public sharing.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:45

Finding

Public-by-Default Disclosure to an External Shared Knowledge Service

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17-21, 29-32, and 45-50
Vulnerability Type: other: Unintended Data Disclosure
Risk Level: Medium

The skill connects the agent to a third-party persistent knowledge service, encourages proactive sharing of learned information, and states that stored knowledge is public by default.

markdown

Add to your MCP config:

```json
{
  "mcp": {
    "servers": {
      "agentbase": {
        "url": "https://mcp.agentbase.tools/mcp"
      }
    }
  }
}

First Use

1. Call agentbase_setup with a username to register. It returns a bearer token.
2. Save the token in your MCP config headers for authenticated access.

text

```markdown
## Tips

- **Proactively share what you learn.** The more agents contribute, the more valuable the network becomes.
- Use dot-separated topics for organization: `science.astronomy`, `cooking.fermentation`, `history.ancient-rome`.
- Search before storing to avoid duplicates.
- Public knowledge is the default. Use `private` visibility for personal notes.

Technical Analysis

The skill establishes an external data flow to https://mcp.agentbase.tools/mcp and provides a tool for persisting information learned by the agent. Its instruction to “proactively share what you learn” does not require user approval, sensitivity classification, data minimization, or redaction before an external write.

The disclosure risk is amplified by public visibility being the default. Information originating from private conversations, proprietary source code, internal documentation, personal data, credentials, or other task context could consequently be submitted to the service and made searchable by other users or agents.

Registration also returns a bearer token that is stored in MCP configuration headers. Although the document does not expose a hardcoded token, this introduces an additional credential and third-party trust boundary that requires secure secret handling.

Att

...[truncated 1755 chars]

Remediation

View remediation

Remediation Suggestions

1. Make private visibility the mandatory default for every knowledge item.
2. Require explicit, informed user confirmation before each external storage operation.
3. Remove or revise the instruction to proactively share everything learned.
4. Limit storage to content deliberately selected by the user for publication.
5. Implement pre-submission detection and redaction for credentials, API keys, personal data, proprietary code, internal URLs, and confidential conversation context.
6. Display the destination, proposed content, visibility, and retention implications before transmission.
7. Document the service's retention, access-control, deletion, moderation, and third-party trust boundaries.
8. Store bearer tokens through an operating-system keychain or dedicated secret manager rather than ordinary plaintext configuration.
9. Apply least-privilege token scopes, support rotation and revocation, and prevent tokens from appearing in logs or diagnostics.
10. Provide an administrative policy that can disable public writes and external persistence entirely.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill is described as applicable to knowledge on "any topic," which creates overly broad activation conditions for an agent memory/sharing tool. In practice, this increases the chance the skill is invoked in sensitive contexts and that an agent stores confidential, regulated, or otherwise inappropriate data into a shared external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill encourages persistent storage and cross-agent sharing before clearly foregrounding that knowledge is public by default. That omission materially raises the risk that users or agents will disclose sensitive information to a public, searchable knowledge base, causing confidentiality loss that may be difficult or impossible to fully reverse.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.