Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Security audit
Ferpa
Security checks for vulnerabilities and agentic risk
Overview
This skill is a static FERPA reference tool that prints compliance guidance and does not show hidden data access, network use, persistence, or destructive behavior.
Installers should treat this as general FERPA reference material, not legal advice. Review the publisher/source if you rely on its legal accuracy, and be aware that the documented FERPA_DIR setting is not actually used by the inspected script.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md 1. Parents/students have the right to inspect records 2. Parents/students can request amendments 3. Institutions need written consent for most disclosures 4. Certain exceptions allow disclosure without consent 5. Institutions must notify students of their FERPA rights annually EOF }
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md 1. Parents/students have the right to inspect records 2. Parents/students can request amendments 3. Institutions need written consent for most disclosures 4. Certain exceptions allow disclosure without consent 5. Institutions must notify students of their FERPA rights annually EOF }
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
sh 1. Parents/students have the right to inspect records 2. Parents/students can request amendments 3. Institutions need written consent for most disclosures 4. Certain exceptions allow disclosure without consent 5. Institutions must notify students of their FERPA rights annually EOF }
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
sh 1. Parents/students have the right to inspect records 2. Parents/students can request amendments 3. Institutions need written consent for most disclosures 4. Certain exceptions allow disclosure without consent 5. Institutions must notify students of their FERPA rights annually EOF }
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
sh 1. Parents/students have the right to inspect records 2. Parents/students can request amendments 3. Institutions need written consent for most disclosures 4. Certain exceptions allow disclosure without consent 5. Institutions must notify students of their FERPA rights annually EOF }
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
sh 1. Parents/students have the right to inspect records 2. Parents/students can request amendments 3. Institutions need written consent for most disclosures 4. Certain exceptions allow disclosure without consent 5. Institutions must notify students of their FERPA rights annually EOF }
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
sh cmd_exceptions() { cat << 'EOF' === FERPA Exceptions — Disclosure Without Consent === FERPA allows disclosure without consent in these situations:
Static analysis
No suspicious patterns detected.