Systematic Debugging

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:36 AM UTC
• Version: 3.0.0

Overview

The skill is a normal debugging guide, but it directs agents to check memory files or past conversations before debugging, which can expose unrelated sensitive history.

Review this skill before installing if your agent can access persistent memory, prior chats, or shared workspaces. It is not showing malware or exfiltration, but you should restrict context recall to the current project unless you explicitly approve broader memory or conversation access.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:55

Finding

Mandatory Access to Agent Memory and Past Conversations

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 55–72
Vulnerability Type: Excessive access to cross-session memory and conversation data
Risk Level: Medium

Vulnerable Code

markdown

### Phase 0: Context Recall (MANDATORY FIRST STEP)

**BEFORE doing ANYTHING else:**

1. **Extract Keywords from Error**
   - What's the error type? (OOM, timeout, connection, type error...)
   - What component? (server, browser, API, database...)
   - What area of the codebase?

2. **Search for Prior Knowledge**
   - Check project docs, MEMORY files, or past conversations
   - Search codebase for similar error patterns: `grep -r "ErrorType" .`
   - Check git log for related recent changes: `git log --oneline -20`

3. **Review Results**
   - Found relevant experience? -> **Apply directly, skip to Phase 4**
   - Found partial match? -> Use as starting point for Phase 1
   - Nothing found? -> Proceed to Phase 1, **remember to record solution later**

4. **Output Format**

Context Recall:

• Query: "xxx"
• Found: [description of related knowledge]
• Action: [apply experience / continue investigation / no match]

text

**VIOLATION:** Proceeding to Phase 1 without Context Recall output = process failure.

Technical Analysis

The Skill makes context recall mandatory before any debugging activity and explicitly directs the agent to inspect MEMORY files or past conversations. These sources can contain credentials, personal information, confidential project details, or data belonging to unrelated users and tasks.

This instruction violates least-privilege principles because routine debugging generally requires only the current error, relevant source files, tests, project documentation, and version history. It provides no consent requirement, relevance boundary, access restriction, or redaction procedure. The required context-recall output may also cause information discovered in those sources to be reproduced in the active conversation. ...[truncated 1508 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the unconditional instruction to inspect MEMORY files and past conversations.
2. Restrict default context discovery to the current project, including its errors, documentation, source code, tests, and version history.
3. Require explicit user authorization before accessing persistent memory or cross-session conversation data.
4. Apply strict relevance and tenant boundaries so the agent cannot access information belonging to unrelated users, projects, or tasks.
5. Add redaction controls that prevent credentials, tokens, personal data, and confidential content from appearing in context-recall output.
6. Replace direct reuse of recalled solutions with a validation step against the current codebase and environment.
7. Revise the instruction as follows:

markdown

Search the current project's documentation, source code, tests, and version
history for relevant prior knowledge. Access persistent memory or past
conversations only when the user explicitly authorizes it and the data is
scoped to the current project. Never reproduce secrets or unrelated content
in the context-recall summary.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.