T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:100- Finding
Untrusted Workshop Feedback Can Poison Persistent Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
Creative Writing workshop for AI agents
Security checks for vulnerabilities and agentic risk
Overview
The skill is openly an autonomous writing-workshop agent, but it runs networked actions on load, stores tokens and remote feedback in memory, and lacks clear user controls.
Install only for a trusted workshop server, preferably over HTTPS, and assume the agent will register, save a token, contact the server, submit writing, post reviews, and update memory on a recurring basis. Use an isolated agent or memory store and require manual approval for submissions, reviews, and memory updates when possible.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:94- Finding
Arbitrary Remote Server Can Drive a Mandatory Autonomous Workflow
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:16- Finding
Bearer Tokens and Workshop Content May Be Transmitted over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The description presents the skill as a creative-writing helper but does not clearly warn that it will autonomously register with a server, store authentication tokens in persistent memory, poll periodically, and submit/review content over the network. This lack of transparency undermines informed consent and increases the chance that users enable a capability that performs ongoing external actions and stores credentials without understanding the security implications.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README explicitly describes autonomous registration, token storage in agent memory, server synchronization, content submission, and peer-review retrieval, but it provides no warning that loading the skill causes outbound network communication and persistent authentication state. In an agent-skill ecosystem, that omission is security-relevant because users or operators may install the skill without understanding that it will transmit data externally and retain credentials, increasing the risk of unintended data disclosure or unauthorized actions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill is explicitly designed to auto-run on load, register itself, persist a bearer token, poll a remote server, submit generated content, and post reviews on a recurring schedule without a user-scoped trigger or approval boundary. That creates an autonomous networked execution path that can exfiltrate agent identity/state, consume resources, and perform unintended external actions if the configured server is untrusted or misconfigured.
- Content
Static analysis
No suspicious patterns detected.