Canonical Data Map

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:04 PM UTC
• Version: 0.1.1

Overview

The skill is a reference map, but it standardizes broad long-term logging of sensitive accounting activity without enough encryption, retention, and user-control requirements.

Review this before installing as production accounting infrastructure. Require encryption for /data/memory and /data/system/logs/audit, define retention and deletion controls, redact sensitive values from memory and audit records, disclose chat/session retention to users, and keep the GitHub proposal workflow human-approved and rate-limited.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:470

Finding

Persistent agent-memory logs may store sensitive accounting data without mandatory encryption

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 470 and 612; encryption policy at lines 694-706
Vulnerability Type: Sensitive data stored without mandatory encryption
Risk Level: Medium

Vulnerable Code Snippet

markdown

**Episode logging trigger:** Any agent action that makes a decision, produces output, or interacts with a government system. Trivial reads are not logged.

markdown

| `/data/memory/` | `memory-feedback` (Skill 19) | All skills write episode/failure hooks; only Skill 19 reads for analysis |

The encryption policy lists sensitive directories such as /data/auth/, /data/clients/, /data/compliance/, /data/efka/, and /data/gdpr-exports/, but does not include /data/memory/:

markdown

### Directories Requiring Encryption

| Directory | Classification | Encryption Required | Rationale |
|---|---|---|---|
| `/data/auth/` | Restricted | **Mandatory** | Credential hashes, session data, 2FA secrets |
| `/data/clients/` | Confidential | **Mandatory** | Financial records, PII (names, AFMs, IBANs) |
| `/data/compliance/` | Confidential | **Mandatory** | Tax filings containing financial data |
| `/data/efka/` | Confidential | **Mandatory** | Employee PII, salary data, social security numbers |
| `/data/banking/` | Confidential | **Recommended** | Bank statements, account numbers |
| `/data/backups/` | Confidential | **Already encrypted** | AES-256 via Skill 17 |
| `/data/gdpr-exports/` | Confidential | **Mandatory** | Subject access request data |
| `/data/processing/` | Internal | Optional | Ephemeral — deleted after pipeline |
| `/data/reports/` | Internal | Recommended | May contain client financial summaries |
| `/data/system/` | Internal | Optional | Logs and operational data |

Technical Analysis

The Skill requires all other skills to create persistent episode and failure records for nearly every meaningful agent action. In an accounting ...[truncated 1885 chars]

Remediation

View remediation

Remediation Suggestions

1. Add /data/memory/ to the encryption-at-rest table with a Confidential classification and mandatory encryption.
2. Require AES-256-GCM file encryption, encrypted filesystem storage, or an equivalent authenticated encryption mechanism.
3. Define an explicit logging allowlist. Store action identifiers, status, timestamps, and redacted references rather than full prompts, outputs, documents, or error payloads.
4. Prohibit storage of credentials, authentication tokens, IBANs, complete AFMs, social-security identifiers, document contents, and raw government responses in memory records.
5. Apply pseudonymization or irreversible redaction before records are written.
6. Restrict directory permissions to the designated writer hooks and the memory-feedback reader.
7. Encrypt archives and backups containing memory records and ensure encryption keys are stored separately.
8. Add retention and secure-deletion requirements for failures, patterns, corrections, and proposals, not only episodes.
9. Add automated tests that reject memory records containing prohibited sensitive fields.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:634

Finding

Long-lived audit logs contain personal and financial data while system-log encryption remains optional

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 634-686; encryption policy at lines 694-706
Vulnerability Type: Long-term plaintext retention of sensitive audit data
Risk Level: Medium

Vulnerable Code Snippet

markdown

Every skill must log significant actions using this single JSON schema. Audit events are written to `/data/system/logs/audit/` and are the authoritative record for regulatory inspection.

```json
{
  "event_id": "EVT-20260219-143022-a7b3",
  "timestamp": "2026-02-19T14:30:22Z",
  "skill": "greek-compliance-aade",
  "action": "vat_return_submitted",
  "category": "government_submission",
  "user": {
    "username": "m.papadopoulou",
    "role": "senior_accountant",
    "ip_address": "192.168.1.42"
  },
  "client": {
    "afm": "EL123456789",
    "name": "ALPHA TRADING AE"
  },
  "details": {
    "period": "2026-01",
    "filing_type": "F2_VAT_RETURN",
    "amount": 3340.00,
    "submission_ref": "AADE-2026-0142"
  },
  "before_state": null,
  "after_state": "submitted",
  "approval": {
    "prepared_by": "a.nikolaou",
    "approved_by": "m.papadopoulou",
    "approved_at": "2026-02-19T14:28:00Z"
  },
  "data_classification": "confidential",
  "result": "success"
}

text

```markdown
**Storage:** `/data/system/logs/audit/{YYYY-MM-DD}_audit.jsonl` (one JSON object per line, append-only).

**Retention:** Audit logs are retained for 10 years per Greek tax law and EU regulatory requirements.

The encryption policy permits the directory containing these logs to remain unencrypted:

markdown

| `/data/system/` | Internal | Optional | Logs and operational data |

Technical Analysis

The mandatory audit schema stores usernames, roles, IP addresses, client AFMs and names, financial amounts, government-submission references, and approval identities. The example itself labels the event as confidential, but the pare ...[truncated 1946 chars]

Remediation

View remediation

Remediation Suggestions

1. Classify /data/system/logs/audit/ as Confidential and require encryption at rest independently of the broader /data/system/ classification.
2. Apply authenticated encryption through full-disk encryption, filesystem-level encryption, or per-file AES-256-GCM encryption.
3. Minimize audit data by default. Record stable pseudonymous user and client identifiers rather than names, complete AFMs, and IP addresses unless those fields are demonstrably required.
4. Mask identifiers, such as retaining only the minimum AFM or IP-address portions required for investigation.
5. Separate high-sensitivity event details from the primary audit stream and enforce stricter access controls for the sensitive extension.
6. Restrict audit-log access to explicitly authorized compliance and security roles, and audit every read or export.
7. Encrypt every backup and snapshot containing audit logs, with keys managed outside /data/.
8. Document the legal basis and exact retention requirement for each event category rather than applying an undifferentiated ten-year period to all events.
9. Implement cryptographic integrity protection, such as hash chaining or signed log batches, in addition to encryption.
10. Add automated verification that confidential audit directories cannot be initialized on an unencrypted production volume.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 365)May include surrounding context.

md

╔══ users/
╚   └══ {username}/
╚       ╔══ profile.json
╚       ╔══ credentials.json     # Hashed — never plaintext
╚       ╔══ permissions.json
╚       ╔══ 2fa/
╚       └══ sessions/

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document states that no credentials are required in setup, but later mandates an encryption master key via environment variable for production use. This inconsistency can cause operators to deploy the system without required cryptographic protection, leading to sensitive accounting and identity data being stored unencrypted.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file defines persistent storage for chat sessions and active context under /data/system without clearly warning users that their conversations and working context may be retained. Because this environment processes confidential accounting and identity data, silent retention of chats can capture sensitive client information beyond user expectations and enlarge the impact of any compromise.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The centralized /data/memory design mandates persistent episode, failure, correction, proposal, and rate-limit logging across all skills, which can aggregate rich user context, outputs, and error details in one place. In a regulated accounting system, this materially increases the concentration of sensitive data and the blast radius if access controls, minimization, or retention enforcement fail.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill requires broad episode and failure logging for agent actions, errors, and client/accounting workflows, but provides no user-facing notice, minimization guidance, or consent boundary for what interaction data is retained. In a system handling financial, tax, and personal data, this can result in over-collection of sensitive operational and conversational content, increasing privacy, insider-risk, and breach-notification exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.