Security audit

Agent Knowledge Transfer

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed agent setup guide, but it can copy private user context and memory into persistent agent workspaces with too few controls.

Install only if you deliberately want this kind of agent provisioning. Before using it, review and redact USER.md, MEMORY.md, AGENTS.md, TOOLS.md, HEARTBEAT.md, and memory logs; avoid --all unless every target agent is approved to receive the same context; and restrict each agent's tools to the minimum needed.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

Confidence: 76% confidence
Finding: The skill description says to use this protocol when creating new agents or when agents report missing skills, but it does not define firm boundaries, authorization checks, or prerequisites. In an agent system, broad activation criteria can cause operators or automation to invoke a sensitive knowledge-copying workflow too readily, increasing the chance of unnecessary data propagation.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The usage section includes vague conditions like incomplete knowledge, migration, or post-configuration activation without measurable thresholds or approval steps. Because this skill performs broad copying of identity, memory, and user context, ambiguous invocation criteria materially increase the likelihood of overuse and accidental disclosure.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: This section explicitly directs copying USER.md, MEMORY.md, AGENTS.md, skills documentation, and memory/history into agent workspaces, but it provides no privacy classification, minimization guidance, or consent boundary. That creates a real risk of transferring sensitive personal, operational, or confidential data into agents that may not need it, expanding exposure and blast radius.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The automation examples include a bulk '--all' mode that can copy knowledge to every agent, yet the skill does not warn about the sensitivity or irreversibility of mass propagation. In practice, one command could replicate private or irrelevant context across the entire fleet, turning a single mistake into a system-wide data exposure event.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The core protocol normalizes copying user context, system knowledge, skills, and memory/history into every new agent workspace. In this context, the skill itself is a data propagation mechanism, so broad natural-language instructions to replicate sensitive state are inherently dangerous because they bypass least-privilege and need-to-know boundaries.

Ssd 3

High

Confidence: 97% confidence
Finding: These steps instruct operators to copy USER.md and recent memory logs directly into the target agent workspace without any privacy scoping, sanitization, or relevance filtering. That is especially risky because memory logs often contain sensitive operational history, and placing them in another agent's workspace grants broader access than may be necessary.

Static analysis

No suspicious patterns detected.