Security audit

The Spaced Repetition Systems for Agents

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent local spaced-repetition tool, but it directs persistent agent memory changes without clear user consent or safeguards.

Install only if you want the agent to maintain a persistent review database and potentially change its own memory based on review outcomes. Before using it, require explicit confirmation for any memory add/delete/update and for card override or removal, especially when cards mention personal, sensitive, or ambiguous information.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared purpose is an interactive spaced-repetition review skill for grading cards and managing memory actions. The actual code chunk does not implement any review-session behavior, card grading, or memory proposal functionality. Instead, it performs configuration management: reading YAML, validating numeric bounds, resolving filesystem paths, and creating a parent directory for a database file. While config loading could be a supporting detail in a larger system, this chunk by itself does not match the declared purpose and introduces undeclared filesystem/configuration behavior unrelated to the stated primary function.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The code clearly supports the spaced-repetition grading portion of the description: it accepts again/hard/good/easy ratings, updates cards via an FSRS scheduler, and exposes retrievability and review-log helpers. However, the declared purpose also says the skill should propose explicit memory add/delete/update actions after each review, and that behavior is absent from this code. The chunk is a backend FSRS service layer rather than a full SRSA daily review session skill. There are no suspicious undeclared external accesses or dangerous capabilities, but the implemented behavior is materially narrower than the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The code clearly supports SRSA-style spaced repetition reviews and card grading, so part of the description is accurate. However, the declared purpose says it is for daily review sessions and for proposing explicit memory add/delete/update actions after each review. The code does not generate such proposals; instead, it directly manages flashcards through commands like card new, override, and rm, and updates scheduling after ratings. It also includes additional operational/status functionality. The main mismatch is that the description frames post-review memory actions as proposals, while the code is a full card-management CLI and lacks any proposal mechanism.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs the agent to perform explicit memory add/delete/update actions, including storing user preferences and corrections, without any consent, retention, or sensitivity warning. This can lead to persistent storage of personal or sensitive user-related information and unintended privacy violations, especially because the workflow normalizes memory changes after each review.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documented override and remove commands are destructive operations that can permanently alter or delete review data, yet the skill provides no warning, confirmation step, or rollback guidance. In practice, an agent could overwrite valid cards or remove data due to ambiguous prompts, mistakes, or adversarial instructions embedded in card content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code performs a filesystem write operation by creating the parent directory for the configured database path. There is no confirmation prompt, logging, print statement, or explanatory comment/docstring in this file to disclose that running the loader may modify the local filesystem.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.