Security audit

feedback-loop

Security checks for vulnerabilities and agentic risk

Overview

This skill is transparent about creating long-term feedback memory, but it also persists user feedback across several agent-control files and can modify governance files, so it deserves manual review before installation.

Install only if you want user feedback to become persistent agent memory and possibly future behavior rules. Before use, require explicit confirmation for any durable write beyond a dedicated feedback log, avoid storing sensitive personal or credential-like information, and review any proposed AGENTS.md, MEMORY.md, skill, config, or git operation before allowing it.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill expands from feedback logging into repository-changing source-control actions by requiring git snapshots and rollback commands on AGENTS.md, MEMORY files, the skill itself, and related configuration. That creates a broad write and history-manipulation capability not inherent to a feedback-loop feature, increasing the chance of unintended destructive changes, persistence of bad state, or misuse to alter safety-relevant files under the guise of 'memory maintenance'.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: Declaring the skill as the 'single source of truth' and instructing bidirectional synchronization with AGENTS.md causes the skill to modify governance or behavior-defining files beyond a narrow feedback mechanism. This can let untrusted conversational feedback indirectly reshape higher-priority operational instructions, creating instruction drift and persistence of unsafe behavior.

Description-Behavior Mismatch

Low

Confidence: 81% confidence
Finding: The skill directs updates to AGENTS.md or other related files whenever feedback is deemed reusable, which broadens persistence beyond the declared feedback chain. This creates a pathway for normal user comments to become durable behavioral rules in shared control files, raising prompt-injection and policy-corruption risk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README explicitly promotes turning user feedback into long-term memory and behavior rules, including persistent writes and retrieval checks, but does not warn users that their feedback may permanently modify stored agent memory or future behavior. This creates a consent and integrity risk: ordinary conversational praise, criticism, or agreement could be silently persisted and later influence outputs in ways the user did not expect.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill mandates writing user feedback into multiple persistent files but does not present a clear user-facing consent notice or warning about durable storage and later retrieval. This is dangerous because users may provide personal, sensitive, or contextual information in feedback that becomes silently retained and mirrored across memory stores.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill instructs repository-changing git snapshot and rollback operations without a clear warning that these actions alter commit history and working-tree state. In practice, such operations can overwrite files, revert unrelated work, or create misleading history if performed automatically in response to conversational feedback.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The skill's core design is to persist and mirror user feedback into feedback-log, conclusions, MEMORY, and retrieval checks, creating redundant natural-language retention of user-provided content. That redundancy increases exposure surface for sensitive information, makes deletion harder, and raises the likelihood of later leakage through retrieval or reuse in unrelated contexts.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The four-step persistence chain explicitly requires broad replication of important feedback across several memory layers and verification that it is retrievable later. This makes any injected, sensitive, or erroneous content more durable and easier to surface in future sessions, amplifying privacy and integrity risks.

Static analysis

No suspicious patterns detected.