Security audit

Active Learner

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its stated purpose, but it can persist arbitrary lesson text into agent memory and has an undocumented file override that can modify other writable files.

Install only if you are comfortable with a skill that can rewrite persistent agent memory. Use it only with trusted lesson text, review MEMORY.md after use, and avoid exposing the command to untrusted automation or inputs. The publisher should document or remove --file, restrict writes to the intended memory file, and add approval/provenance checks before persistence.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Error

Location: index.js:28
Finding: Persistent Agent Memory Poisoning Through Untrusted Lesson Content
Content: View full analysis
50 ? '...' : ''); const type = "Lesson"; ``` ```js const detailEntry = `\n### ${id} | ${category} | ${summary}\n**Date:** ${new Date().toISOString().split('T')[0]}\n${text}\n`; content += detailEntry; fs.writeFileSync(MEMORY_FILE, content); console.log(`Successfully internalized ${id} to MEMORY.md (Index + Detail)`); ``` ### Technical Analysis The `internalize` command treats the caller-controlled `text`, `category`, and `id` arguments as trusted memory content and stores them in `MEMORY.md`. The implementation does not distinguish factual lesson data from executable natural-language instructions. Only pipe characters in the first-line summary are replaced. The complete `text` value is appended without sanitization, and `category` and `id` are interpolated into Markdown headings and table content ...[truncated 1906 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: index.js:28
Finding: Arbitrary Existing File Modification Through Unrestricted --file Path
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill description explicitly says it can programmatically internalize lessons into MEMORY.md, but it does not warn that this alters persistent agent memory. That omission can cause users or higher-level orchestration to invoke the skill without understanding it performs state-changing writes, increasing the risk of memory poisoning, persistence of bad instructions, or accidental storage of untrusted content.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 93% confidence
Finding: The dependency uses a caret range (^1.2.8), which allows automatic installation of newer compatible versions rather than a single fixed version. This increases supply-chain risk and can reduce build reproducibility if a later published version introduces malicious code or a breaking security regression.
Content: Scanner excerpt · package.json (reported line 10)May include surrounding context.
json
"start": "node index.js" }, "dependencies": { "minimist": "^1.2.8" } }