Security audit

D.E.E.P. Framework

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local personality-memory utility, but it asks agents to persist behavioral state and exposes a safety check that always approves actions without real validation.

Install only if you are comfortable with persistent local personality and memory files. Do not store secrets, credentials, private relationship data, or authoritative safety rules in these files, and do not rely on deep_triple_check as a real safety gate until it performs actual validation and fails closed.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:16
Finding: Persistent Agent State Can Store Untrusted Behavioral Instructions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: deep_tool.py:47
Finding: Mandatory Safety Check Unconditionally Approves Every Action
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill advertises executable commands that read from and write to local files, but it does not declare any tool scope, permissions, or allowed-tools boundaries. This creates a transparency and least-privilege problem: an agent or user may invoke file-capable functionality without explicit policy constraints, increasing the chance of unintended access or modification to local state.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs users to maintain persistent personality, relationship, reflection, and core memory files, which can accumulate sensitive or intimate data over time. Without any warning about persistence, retention, access controls, or sensitivity, users may store confidential information in plaintext and expose it to other tools, future sessions, or unintended readers.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The deep_sync command explicitly consolidates the pillar data into soul_vault.json, creating a derived persistent store that may centralize sensitive memory and identity data in one place. Doing so without disclosure or safeguards increases the blast radius of any local compromise, accidental commit, or unauthorized read because multiple categories of state are aggregated into a single file.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest describes a broad 'cognitive architecture for agentic sovereignty and partnership,' which implies substantive reasoning or personality framework behavior. In practice, the code just checks for expected markdown files, extracts bullet-form key/value pairs, and serializes them into a local JSON file, which is a much narrower file-management utility.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The code overwrites soul_vault.json unconditionally, which can destroy prior state or curated data without warning. In a memory/personality storage context, silent overwrite can lead to integrity loss, accidental data corruption, or rollback of trusted state if the tool is invoked unexpectedly or repeatedly.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The triple_check function claims to validate actions against Constitution, Identity, and Goals but always returns a passing verdict without performing any checks. In an agentic skill context, this can create a false sense of safety and allow downstream systems or operators to trust unsafe actions that were never actually evaluated.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.