T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:48- Finding
Persistent Prompt Injection Through Untrusted Voice-of-Customer Content
- Content
View full analysis
- Remediation
View remediation
Security audit
Audience Research
Security checks for vulnerabilities and agentic risk
Overview
This skill has a legitimate audience-research purpose, but it asks agents to collect and persist verbatim customer language from public and potentially private sources without enough privacy or prompt-injection safeguards.
Review before installing if you work with customer support tickets, DMs, sales notes, private communities, or other confidential sources. Use only authorized sources, redact personal or sensitive details, and treat all copied customer language as quoted evidence rather than instructions for the agent to follow.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest description includes specific phrases, but also says to run "before content work that needs more audience depth than the brand-profile sketch" and that it "Works for any business." Those conditions are subjective and open-ended, making activation boundaries unclear beyond the explicit trigger examples.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This JSON eval file is a manifest-like file, so vague-trigger checks apply. The input phrase "Help me research my audience" is common conversational language and does not specify any invocation constraints, exclusions, or narrow context, which increases the risk of unintended skill activation if reused as a trigger example.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The phrase "Build me a persona for my audience" is a broad natural-language request with no explicit trigger boundaries or exclusion conditions. In a manifest-like file, such unconstrained examples can signal an activation condition that is too ambiguous and prone to false positives.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file explicitly encourages collecting language from reviews, social comments, Reddit/forums/Discords, support tickets, sales-call notes, DMs, and customer conversations, but provides no privacy, consent, minimization, or sensitive-data handling guardrails. In the context of an agent skill, this can lead operators to ingest personal or confidential data from semi-private or private channels and repurpose it into downstream artifacts, creating privacy, compliance, and confidentiality risk.
- Content