Security audit

SageMaker

Security checks for vulnerabilities and agentic risk

Overview

This skill openly builds persistent agent memory, but its mandatory updates and broad future influence need review before installation.

Install only if you want this agent to maintain persistent memory that can affect later tasks. Review memory changes before promotion, keep memory scoped per project or user, and treat repository text, documents, web content, and tool output as untrusted evidence that should not become standing behavioral rules without approval.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:34
Finding: Persistent Agent-State Influence Through Mandatory Memory Promotion
Content: View full analysis
mid + prune short-term retention - Weekly cycle: promote mid->long - Heartbeat: recovery path only (when gate remains pending) Strict rule: success is valid only if gate flips to d ...[truncated 2932 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill description is very broad ('unified memory-and-growth operating system for agents' and 'any equipped agent can run the same self-calibration workflow') and does not define clear triggering boundaries, task types, or safety exclusions. In agent frameworks, overly broad invocation criteria can cause the skill to be applied in unintended contexts, leading to unnecessary file reads/writes, workflow hijacking, or propagation of behavior-governing changes into tasks that did not require this memory system.
Content: No source excerpt is available for this finding.