Security audit

Machine Learning Roadmap

Security checks for vulnerabilities and agentic risk

Overview

This skill is labeled as an ML roadmap planner but mainly behaves as a persistent local content logger and exporter, so users should review it carefully before installing.

Install only if you actually want a local ML-content note logger, not a roadmap planner. Avoid entering secrets or sensitive drafts, know that entries and exports are stored under ~/.local/share/machine-learning-roadmap, and review or delete that directory manually if you no longer want the retained data.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:58
Finding: Unescaped User-Controlled Data in JSON and CSV Exports
Content: View full analysis
"$out" local first=1 for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do [ $first -eq 1 ] && first=0 || echo "," >> "$out" printf ' {"type":"%s","time":"%s","value":"%s"}' "$name" "$ts" "$val" >> "$out" done < "$f" done echo "\n]" >> "$out" ;; csv) echo "type,time,value" > "$out" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local name=$(basename "$f" .log) while IFS='|' read -r ts val; do echo "$name,$ts,$val" >> "$out"; done < "$f" done ;; ``` ### Technical Analysis Values read from the log files are incorporated directly into JSON and CSV output without format-appropriate encoding. For JSON exports, characters such as double quotes, backslashes, carriage returns, and control characters are not escaped. An attacker-controlled value can terminate the intended JSON string, inject additional properties or objects, or make the document invalid. The output should be generated using a conforming JSON serializer rather than string interpolation. For CSV exports, fields are neither quoted nor escaped. Commas, quotes, and newlines can create additional fields or records. More importantly, values beginning with spreadsheet formula prefixes such as `=`, `+`, `-`, or `@` may be interpreted as formulas when the CSV file is opened in spreadsheet software. Depending on the spreadsheet applicati ...[truncated 2461 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/script.sh:110
Finding: Option Injection Through the Search Term Passed to grep
Content: View full analysis
}" echo "Searching for: $term" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local m=$(grep -i "$term" "$f" 2>/dev/null || true) if [ -n "$m" ]; then echo " --- $(basename "$f" .log) ---" echo "$m" | sed 's/^/ /' fi done } ``` ### Technical Analysis The search term is quoted, which prevents shell word splitting and shell metacharacter execution. However, quoting does not prevent an argument beginning with `-` from being interpreted as a command-line option by `grep`. Because the invocation does not place the `--` end-of-options delimiter before the user-controlled term, an attacker can supply `grep` options instead of a literal search pattern. Options such as `-e`, `-f`, or implementation-specific flags can alter pattern selection, cause `grep` to read patterns from another accessible file, change matching behavior, or increase resource consumption. This is not shell command injection: command substitutions, semicolons, and similar shell syntax inside the quoted term are not executed. The vulnerability is limited to manipulation of `grep` semantics. ### Attack Path 1. An attacker controls or influences the argument supplied to the `search` command. 2. The attacker supplies an option-like term instead of a normal pattern, such as: ```bash machine-learning-roadmap search '-e.*' ``` 3. The script invokes: ```bash grep -i "-e.*" "$f" ``` 4. `grep` interprets the attacker-controlled argument as an option and attached pattern rather than as a literal term. 5. The attacker changes the scope or behavior of the search. More complex options supported by the installed `grep` implementation may cause unexpected fil ...[truncated 842 chars]
Remediation: View remediation
/dev/null || true) ``` Additional hardening measures include: 1. Use fixed-string matching if regular expressions are not required: ```bash grep -iF -- "$term" "$f" ``` 2. Enforce a reasonable maximum search-term length to reduce denial-of-service risk. 3. Avoid declaring and assigning a command-substitution result in one `local` statement, because that can obscure the command's exit status. 4. Add tests for search terms beginning with `-`, including `-e`, `-f`, and `--`, and confirm that they are handled as literal input. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill’s declared purpose is ML roadmap planning, but the documented behavior is a local content-management and logging toolkit with persistent storage, export, and search capabilities. This mismatch is dangerous because users and orchestrators may invoke the skill under false assumptions, causing unrelated user content to be collected and retained unexpectedly.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The manifest advertises a study-roadmap skill, while the file documents a content logging/export tool. This creates a trust and transparency failure that can mislead users into providing data for one purpose while the skill performs another, including storing and exporting local content.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The inline comments explicitly identify the script as a content toolkit, directly contradicting the manifest's ML roadmap identity. This inconsistency is a strong signal of deceptive packaging or poor governance, both of which undermine user trust and can conceal functionality that would have been scrutinized under an accurate label.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The implemented commands expose a generic content-writing and logging toolkit that does not match the declared purpose of an ML roadmap planner. This kind of capability mismatch is dangerous because it can mislead users and reviewers about what the skill really does, increasing the chance that unrelated data collection and workflow behavior are executed under false pretenses.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Capabilities such as hashtags, hooks, CTA, headline, tone, and translation are unrelated to a machine-learning roadmap skill and suggest a repurposed or mislabeled tool. Such unjustified features expand the skill's behavior beyond user expectations and make deceptive deployment or unauthorized data collection more plausible.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Presenting the skill as a 'Machine Learning Roadmap' while describing it as a 'content toolkit' introduces deceptive framing about what the skill does. Although less severe than a full manifest mismatch, it still increases the chance of inappropriate activation and accidental disclosure of user content into local logs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill stores user-provided content locally and supports export/search, but the documentation does not prominently warn about privacy, retention, and sensitivity implications. This can lead users to enter confidential notes, drafts, or personal data without informed consent about persistence and later retrieval.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 89% confidence
Finding: The examples and storage model indicate persistent logging of user inputs across sessions, which creates a session-retention risk. In context, the danger is not arbitrary code execution but accumulation of potentially sensitive content that can later be searched, exported, or exposed to other local processes/users depending on environment configuration.
Content: Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.
md
# Draft a new ML blog post idea machine-learning-roadmap draft "Introduction to Neural Networks: A Beginner's Guide" # Create an outline for a tutorial machine-learning-roadmap outline "1. What is ML? 2. Supervised vs Unsupervised 3. Tools 4. Practice Projects" # Record a headline variation

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script creates a persistent data directory and writes user activity to disk even though the skill description does not indicate storage or logging. Hidden persistence is risky because users may enter sensitive notes or plans assuming ephemeral processing, and those inputs will remain locally available for later disclosure or unintended reuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The export command aggregates previously stored entries into new files without clearly informing the user that historical content will be copied and materialized again on disk. This increases exposure by duplicating potentially sensitive data into additional artifacts that may be shared, synced, or left behind unintentionally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: User-provided content is appended to local log files without any upfront warning at the point of collection. This is dangerous because users may provide proprietary study plans, credentials pasted by mistake, or other sensitive text that is silently retained on disk and exposed to other local users, backups, or later exports.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description says to use the skill when 'planning study paths, discovering resources, mapping skills,' which is broad and lacks clear boundaries on when the skill should or should not activate. Because this is a markdown/manifest-scoped trigger description without exclusions or negative examples, it could cause unintended invocation for generic learning-planning requests.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.