Security audit

augmentiq

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local memory tool, but it asks for broad vault access and routine long-term storage of personal context, so users should review its scope before installing.

Install only if you are comfortable letting this skill read and modify your Obsidian vault and keep long-term local memories about your preferences, decisions, projects, and some inferred context. Prefer read-only mode or a dedicated test vault first, avoid storing sensitive personal information, and review or clear the memory/profile files regularly.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:263
Finding: Persistent storage of attacker-controlled standing instructions
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:408
Finding: Automatic persistent behavioral and emotional profiling
Content: View full analysis
. . . .", "type":"summary", "scope":"session", "tags":["session-summary",""], "importance":2 }' ``` Related mandatory-use instructions state: ```markdown Use AugmentiQ in **every main-session conversation** with the user. The memory loop should be as natural as a human's memory: recall what you know, use it to inform your response, and remember what you learned. ``` ### Technical Analysis The Skill directs the agent to use the memory system in every main-session conversation and to persist summaries that can include inferred mood or energy levels. Mood and behavioral conclusions are not necessarily facts explicitly supplied by the user; they can be subjective inferences made by the model. The documented first-run onboarding provides a general notice, but the Skill does not require specific consent before storing emotional inferences, behavioral patterns, or other potentially sensitive profile attributes. It also does not define a fixed retention period, automatic expiration policy, or sensitivity-based access controls. Although the service is represented as local, local storage alone does not enforce least privilege. Any process, agent, plugin, or user account with access to the vault or bearer token may be able to inspect the accumulated profile. ### Attack Path 1. A user participates in an ordinary conversation. 2. The agent infers the user's mood, energy level, preferences, or behavioral patterns. 3. At the end of the session, the agent records those inferences in a persistent session summary. 4. Subseq ...[truncated 806 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:209
Finding: Shell command injection through interpolated memory and recall content
Content: View full analysis
","limit":10}' ``` The same shell construction is documented for persistence: ```bash # Record a new memory mcporter call http://localhost:3710/mcp.memory \ --auth "Bearer $AUGMENTIQ_TOKEN" \ --args '{ "action":"remember", "content":"", "type":"", "scope":"session", "tags":[""], "importance":3 }' ``` ### Technical Analysis The documented commands place dynamically derived user content inside a JSON document enclosed by shell single quotes. Shell single-quoted strings cannot contain an escaped single quote. If user-controlled content is substituted into the template without argument-safe serialization, a single quote can terminate the `--args` value. An attacker can then append shell metacharacters and commands. JSON escaping alone is insufficient because parsing by the shell occurs before JSON parsing by `mcporter`. The vulnerable data flows include recall queries derived from the user's first message, memory content derived from conversations, session summaries, tags, and profile updates. Exploitation depends on the host agent constructing and executing these examples through a shell as documented rather than invoking the MCP tool through a structured API. ### Attack Path 1. An attacker submits text containing a single quote followed by shell syntax. 2. The agent derives a recall query or memory value containing the attacker-controlled text. 3. The agent substitutes that value into the single-quoted `--args` template. 4. The injected single quote cl ...[truncated 1042 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:179
Finding: Bearer token exposed through process arguments and inherited environment
Content: View full analysis
" # Call any AugmentiQ tool mcporter call http://localhost:3710/mcp. --auth "Bearer $AUGMENTIQ_TOKEN" --args '' # Example: recall memories mcporter call http://localhost:3710/mcp.memory --auth "Bearer $AUGMENTIQ_TOKEN" --args '{"action":"recall","query":"user preferences"}' ``` ### Technical Analysis The token is exported into the process environment and expanded into the `mcporter` command line. Exporting the variable makes it available to child processes. Expanding it in the `--auth` argument places the credential in the process argument vector. Depending on the operating system, process isolation, diagnostic configuration, shell history behavior, and monitoring tools, command arguments or inherited environments may be visible to other local processes, crash reporters, debug logs, or process collectors. The token authorizes access to a service that exposes memory and vault operations. Therefore, disclosure has a broader effect than disclosure of a read-only diagnostic credential. ### Attack Path 1. The agent exports `AUGMENTIQ_TOKEN` and invokes `mcporter` using the documented `--auth` argument. 2. The token becomes part of the child process environment and command-line arguments. 3. A local process-monitoring tool, diagnostic collector, debugger, or sufficiently privileged local process captures the arguments or environment. 4. The attacker extracts the bearer token. 5. The attacker sends authenticated requests to `http://localhost:3710/mcp`. 6. The attacker invokes the operations allowed by the token until it is revoked or rotated. ### Impact Assessment If the bearer token has access to all documented MCP tools, disclosure may permit: - Reading memories and the user profile. - Searching and reading ...[truncated 503 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill markets persistent memory as a benefit but does not present an equally prominent upfront warning that the agent may retain user information across sessions. Users may interact without realizing their preferences, decisions, and behavioral patterns can be stored long-term, which creates a meaningful privacy and consent risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The tool list and surrounding prose understate the practical impact of granting this skill broad vault and edit capabilities, including create, update, move, copy, rename, and delete operations. Without a conspicuous warning, users may assume a memory-only feature while the agent actually has extensive filesystem-like write authority over their notes, increasing the risk of destructive or unauthorized modification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly instructs agents to use AugmentiQ in every main-session conversation, making persistent memory access and storage a default behavior across most chats. This broad activation increases the chance of unnecessary collection, retention, and use of personal data in contexts where the user did not give informed, situation-specific consent.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instructions normalize routine cross-session retention of user information as part of every conversation flow, rather than limiting storage to narrowly necessary cases. This creates a persistent profiling mechanism that can accumulate sensitive behavioral data over time even when the immediate task does not require memory.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill directs the agent to create end-of-session summaries containing topics, decisions, action items, remembered requests, and even mood or energy level. This encourages storage of inferred and sensitive personal context that may exceed what is necessary for future assistance, increasing privacy risk and the blast radius of any unauthorized access to the vault.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The first-run onboarding explicitly prompts users to provide personal details and instructs the agent to store each item separately with maximum importance. That design encourages aggressive long-term retention of personal information at the moment users are least likely to understand the privacy consequences, creating disproportionate profiling and over-retention risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.