Security audit

Taste

Security checks for vulnerabilities and agentic risk

Overview

This taste-learning skill is coherent, but it keeps open-ended local memory of user feedback and uses it in future sessions without enough limits or user controls.

Install only if you are comfortable with the agent writing long-lived taste notes under ~/taste/. Avoid giving sensitive personal details, credentials, or operational instructions as feedback while this skill is active, and periodically inspect or delete the stored taste files if they no longer reflect your preferences.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:8
Finding: Unvalidated Human Feedback Can Poison Persistent Taste Memory
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to persist user corrections, preferences, and extracted patterns under ~/taste/ without informing the user or placing limits on what may be stored. This creates a privacy and data-governance risk because subjective feedback and preferences can contain sensitive personal information, and long-lived local storage increases exposure to unauthorized access, unintended reuse, or retention beyond the user's expectations.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instruction to "record everything" about user corrections, hypotheses, and confirmations encourages persistent retention of interaction data without any stated minimization, consent, retention limit, or sensitivity filtering. In a learning skill centered on adapting to a human’s preferences, those corrections can easily include personal preferences, behavioral patterns, and other profiling data, creating privacy and misuse risk if stored broadly or indefinitely.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The typography guidance states universal-sounding rules such as 'almost always right,' 'maximum,' and 'definitely wrong' without framing them as user-selectable preferences or context-specific advice. Because SQP-3 covers natural-language policy issues like forcing a specific language or locale style, this prescriptive wording can be read as imposing one design norm rather than offering optional guidance.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.