Security audit

Learning Evolution

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent and transparent, but its local report generators can overwrite predictable output paths, creating a real file-corruption risk in shared or untrusted directories.

Install only if you are comfortable with the skill creating local Markdown reports. Keep LEARNING_DATA_DIR unset or point it to a private, trusted directory you own, and avoid running the generators in shared or attacker-writable directories until the overwrite behavior is fixed.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/analyze-usage.sh:47
Finding: Symlink-Following Report Overwrite in Usage Analysis Generator
Content: View full analysis
"$REPORT_FILE" ``` ### Technical Analysis The report filename is predictable because it consists only of a validated skill name and the current date. The destination dir ...[truncated 1605 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/track-effectiveness.sh:46
Finding: Symlink-Following Report Overwrite in Effectiveness Generator
Content: View full analysis
"$REPORT_FILE" ``` ### Technical Analysis The script constructs a predictable output path from the supplied skill name and current date. Although the skill name ...[truncated 1396 chars]
Remediation: View remediation
` redirection. - Prefer `open()` with `O_CREAT | O_EXCL | O_NOFOLLOW`, or use secure temporary-file creation in the destination directory followed by a carefully validated atomic rename. - Refuse to overwrite an existing report by default. If replacement is needed, require an explicit option and verify the existing object is a regular file owned by the current user. - Set `umask 077` before creating reports that may later contain user feedback or operational data. - Extend `scripts/test.sh` with symlink, pre-existing-file, ownership, and shared-directory test cases. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/suggest-evolutions.sh:46
Finding: Symlink-Following Report Overwrite in Evolution Planning Generator
Content: View full analysis
"$REPORT_FILE" ``` ### Technical Analysis The generated filename can be predicted from the skill name and current date. The script permits redirection of reports through `LEARNING_DATA_DIR`, creates the directory if needed, and then writes the report using `>`. The redirection follows symbolic links and truncates the resolved target. There is no exclusive creation, no `O_NOFOLLOW` equivalent, and no validation that the final d ...[truncated 1067 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill clearly instructs the agent to run local shell scripts, but it does not declare any explicit tool scope such as allowed tools or permissions. That creates an authorization ambiguity where an orchestrator may permit shell execution more broadly than intended, increasing the chance of unintended local command execution in response to loosely related prompts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger examples are broad, natural-language phrases like '这个skill最近用得怎么样' and '接下来该改什么', which can overlap with ordinary conversation about a skill. In a system with automatic skill routing, this can cause unintended activation and lead the agent to run local scripts or generate persisted analysis files when the user did not explicitly request tool use.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The document substantially mixes Chinese and English in headings, instructions, examples, and output labels, but does not explain whether the skill should respond in a specific language or adapt to the user's preference. This can create a language/locale policy issue if the skill implicitly steers output language without explicit user choice.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.