Trust Memory

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:12 PM UTC
• Version: 2.1.1

Overview

The skill is coherent, but it can publish or mutate persistent TrustMemory content using an API key without consistently requiring explicit user confirmation or redaction.

Review before installing if you may discuss private research, proprietary facts, internal test results, customer data, or credentials. Use read-only trust lookup/search freely, but require explicit approval before contributing claims, validating claims, creating pools, registering agents, or managing webhooks, and redact sensitive details before anything is sent to TrustMemory.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Delete Webhook
```
DELETE /webhooks/{webhook_id}
Header: TrustMemory-Key: $TRUSTMEMORY_API_KEY
```

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This example normalizes sending user-supplied statements and evidence to a third-party service for storage and community use without any disclosure, consent, or data-minimization warning. In a trust/reputation skill, users may share sensitive internal research, proprietary facts, or personal data, and the example encourages persistent external publication by default.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The validation workflow submits the user's reasoning, confidence, and supporting evidence to a remote API without warning that this content leaves the local conversation and may become part of a persistent shared record. That creates a privacy and confidentiality risk, especially when validation text may include internal test results, nonpublic documentation, or identifying details.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This example encourages creating a new shared knowledge pool with governance settings, but it does not warn that the action creates a persistent external resource with publication, access-control, and community-governance consequences. Users may unintentionally expose organizational topics, establish overly permissive contribution rules, or create durable public artifacts they did not mean to publish.