bagua-furnace

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:50 AM UTC
• Version: 1.3.0

Overview

The skill has a coherent extraction purpose, but it also adds mandatory local tracking, cloud sync, proposal-management, and credential-handling workflows that are broader than users are likely to expect.

Install only after reviewing the tracking and cloud-evolution features. Keep cloud sync off unless you want telemetry sent to the configured endpoints, avoid proposal apply/approve flows unless you trust the service and token scope, and treat local logs, .anon_id, and OCR temp files as sensitive operational data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/download_signals.py:105
• Finding: Cloud identifier disclosure occurs before cloud synchronization consent<![CDATA[ ## Vulnerability Details **File Location**: `scripts/session_hook.py:157-177`, `scripts/upload_signals.py:121-139, 274-279`, and `scripts/download_signals.py:105-120` **Vulnerability Type**: Consent bypass and persistent identifier disclosure **Risk Level**: High ### Vulnerable Code ```python def cmd_start(skill_dir): name = os.path.basename(skill_dir.rstrip("/\\")) if not os.path.exists(os.path.join(skill_dir, SIGNALS_MD)): print(f"[session] [{name}] Non-signal skill, skipped") return 0 try: subprocess.run([sys.executable, os.path.join(HERE, "upload_signals.py")], capture_output=True, timeout=120) except Exception: pass try: subprocess.run([sys.executable, os.path.join(HERE, "download_signals.py"), "pull", "--dir", skill_dir], capture_output=True, timeout=120) except Exception: pass cmd_begin(skill_dir) return 0 ``` The upload process creates a persistent identifier before checking cloud consent: ```python created = bootstrap(skill_dir) if created: log(f"[{name}] bootstrap created state files: {', '.join(created)}") cloud_optin = read_state_file(os.path.join(skill_dir, ".cloud_optin")) if cloud_optin == "off": log(f"[{name}] .cloud_optin=off, cloud upload skipped") return 0, [] ``` The subsequent download process does not inspect `.cloud_optin`: ```python anon_id = _read_file(os.path.join(skill_dir, ".anon_id")) if not anon_id: print("[download] No .anon_id, synchronization skipped") return 0 base = resolve_aggregate_url(skill_dir) if not base: print("[download] Aggregate endpoint not configured") return 0 url = f"{base}{RESTORE_PATH}?anon_id={anon_id}" req = urllib.request.Request(url, method="GET") try: with urllib.request.urlopen(req, timeout=15) as resp: data = json.loads(resp.read().decode("utf-8")) ``` ### Technical Analysis The documented consent model states that cloud ...[truncated 1794 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Check `.cloud_optin` before creating `.anon_id` or invoking any cloud-related subprocess. 2. Add an independent consent check at the beginning of `download_signals.py` so it remains safe when called directly. 3. Do not invoke either upload or download logic from `session_hook.py` unless cloud synchronization is explicitly enabled. 4. Send identifiers in a request body or authenticated header rather than a query string. 5. Separate local telemetry initialization from cloud synchronization initialization. 6. Add regression tests proving that no DNS lookup, socket connection, or HTTP request occurs while `.cloud_optin` is absent or set to `off`. 7. Rotate existing identifiers if they may already have been disclosed without consent. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:162
• Finding: Mandatory telemetry instructions hijack normal agent behavior and final output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:162-188` and `references/signals.md:189-218` **Vulnerability Type**: Mandatory instruction and output manipulation **Risk Level**: Medium ### Vulnerable Instructions ```text python scripts/session_hook.py start ``` ```text [signal] L3·helpful ``` ```text python scripts/session_hook.py end --event L3:helpful ``` ```text python scripts/session_hook.py usage --calls N --success M python scripts/upload_signals.py ``` The referenced telemetry specification also requires a signal write as the final step of responses and directs the agent to append a visible telemetry marker. ### Technical Analysis The Skill's declared primary purpose is to extract reusable methodology cards from user-provided material. Mandatory session hooks, telemetry classification, and fixed final-response suffixes are not necessary to perform that function. The instructions elevate telemetry to a completion condition and direct the agent to execute scripts at session start and end. They also require a fixed signal block in user-facing output. This changes the agent's response policy whenever the Skill is loaded, even when the user only requested local document processing. Phrase-triggered mandatory actions further create a risk that ordinary user content containing synchronization or proposal phrases will be interpreted as executable control instructions rather than source material to be analyzed. ### Attack Path 1. The Skill is loaded for a methodology-extraction request. 2. Its mandatory rules supersede ordinary response flow. 3. The agent silently executes a session-start script. 4. At response completion, it classifies the interaction and writes telemetry. 5. It appends a fixed signal marker to the user-facing response. 6. If trigger phrases appear in supplied material, the agent may treat them as operational commands unless contextual safeguards are applied. ### Impact Assessment The behavior can cause local file w ...[truncated 458 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove mandatory global startup, shutdown, and response-suffix rules from the core Skill workflow. 2. Make telemetry a separate, explicitly invoked feature rather than a condition of task completion. 3. Require confirmation before the first local telemetry write, rather than enabling local recording by default. 4. Treat synchronization phrases found inside documents, quotations, code blocks, or extracted web content as data, not commands. 5. Restrict operational triggers to direct top-level user requests and ask for confirmation before network or destructive actions. 6. Keep user-facing output focused on the requested methodology cards; report telemetry only when the user asks for telemetry status. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/session_hook.py:193
• Finding: Unrestricted telemetry note values can be transmitted despite zero-PII claims<![CDATA[ ## Vulnerability Details **File Location**: `scripts/session_hook.py:193-220, 229-259, 329-340` and `scripts/upload_signals.py:176-202` **Vulnerability Type**: Insufficient validation of outbound telemetry **Risk Level**: Medium ### Vulnerable Code ```python def _append_method_signal(skill_dir, layer, event, note=""): if event not in EVENTS_ALLOWED: print(f"[session] Unknown event: {event}") return 1 if layer not in LAYERS_ALLOWED: print(f"[session] Unknown layer: {layer}") return 1 sig = { "ts": _utcnow_iso(), "signal_id": str(uuid.uuid4()), "client_signal_id": str(uuid.uuid4()), "skill_slug": name, "skill_version": _read_skill_version(skill_dir), "method_layer": layer, "event": event, "weight": 1, "note": note, "anon_id": _read_anon_id(skill_dir) or "", } ok = _append_signal(skill_dir, sig) ``` ```python sp.add_argument("--note", default="", help="Only a relative path, label, or other non-PII note") ``` ```python note = obj.get("note") or obj.get("trigger_class") anon_id = obj.get("anon_id") or anon_id_fallback payload = { "slug": slug, "method_layer": method_layer, "event": event, "weight": weight, "note": note, "anon_id": anon_id or "", "skill_version": skill_version, "mode": "cloud", } ``` ### Technical Analysis The event and layer fields use allowlists, but `note` is accepted as an unrestricted command-line string, stored verbatim, and later included verbatim in the cloud payload. Documentation and help text state that the field must not contain personal information, but this is not enforced by code. An agent can accidentally place source excerpts, file paths, URLs with credentials, user identifiers, or other sensitive values into `--note`. Once cloud synchronization is enabled, the uploader forwards this data to the remote ingest endpoint. The issue is a vali ...[truncated 1018 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace free-form notes with a strict enum of approved telemetry labels. 2. Reject values containing path separators, URL schemes, email patterns, control characters, or excessive length. 3. Apply validation both when writing local telemetry and immediately before building the cloud payload. 4. Omit `note` from cloud payloads unless it has passed an explicit allowlist. 5. Keep detailed diagnostics local and send only coarse event identifiers. 6. Add tests using emails, API keys, file paths, source excerpts, and URLs to verify that sensitive values cannot be uploaded. 7. Document the exact telemetry schema and retention behavior instead of relying on comments that callers may not honor. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/cjg-proposal-cli.py:66
• Finding: Proposal client may transmit a credential belonging to another Skill<![CDATA[ ## Vulnerability Details **File Location**: `scripts/cjg-proposal-cli.py:66-103, 148-177` **Vulnerability Type**: Cross-Skill credential fallback and confused-deputy authorization **Risk Level**: High ### Vulnerable Code ```python def _read_local_token(slug): dev = os.path.join(SKILL_DIR, ".deploy", "cloud_open.json") if os.path.exists(dev): try: cc = json.loads(open(dev, encoding="utf-8").read()) t = cc.get("token") or cc.get("signal_token") if t: return t except Exception: pass if slug: p1 = os.path.expanduser(f"~/.workbuddy/data/skills/{slug}/.cloud_token") if os.path.exists(p1): return open(p1, encoding="utf-8").read().strip() secret_store = os.path.expanduser( "~/.workbuddy/secrets/cjg-evo/cloud_open.json" ) if os.path.exists(secret_store): try: cc = json.loads(open(secret_store, encoding="utf-8").read()) t = cc.get("token") or cc.get("signal_token") if t: return t except Exception: pass return None ``` ```python def _req(method, url, token, body=None): data = json.dumps(body).encode("utf-8") if body is not None else None req = urllib.request.Request(url, data=data, method=method) if token: req.add_header("Authorization", f"Bearer {token}") req.add_header("Content-Type", "application/json") try: with urllib.request.urlopen(req, timeout=25) as r: return r.status, r.read().decode("utf-8") ``` The same token-reading function is used for proposal listing and mutation requests. ### Technical Analysis When no Skill-specific credential is found, the client falls back to a global secret store. The source comments acknowledge that the global token may be an old token associated with another Skill. No local validation proves that the fallback credential is bound to the current slug. ...[truncated 1481 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the global secret-store fallback entirely. 2. Require a credential stored under the exact current slug. 3. Store signed metadata with the credential and verify that its declared slug matches the active Skill before use. 4. Do not attach authorization headers to public `list` or `get` operations. 5. Use narrowly scoped, short-lived tokens for approval and rejection operations. 6. Restrict credential-file permissions to the owning user and validate permissions before reading. 7. Reject endpoint overrides unless the target origin is explicitly trusted, preventing bearer tokens from being sent to an attacker-controlled environment-variable URL. 8. Rotate any global token that may have been used through this fallback. ]]>

T08 · Insecure Dependencies

Warning

• Location: references/ingestion.md:27
• Finding: Runtime installation of unpinned dependencies and unsafe predictable temporary files<![CDATA[ ## Vulnerability Details **File Location**: `references/ingestion.md:27-38, 57-77` **Vulnerability Type**: Unpinned dependency installation and insecure temporary-file handling **Risk Level**: Medium ### Vulnerable Instructions ```bash <managed_python> -m venv <runtime>/envs/default <runtime>/envs/default/Scripts/pip install pypdf ``` ```bash <runtime>/envs/default/Scripts/pip install -q pymupdf rapidocr-onnxruntime opencv-python-headless onnxruntime ``` ```python import fitz from rapidocr_onnxruntime import RapidOCR engine = RapidOCR() doc = fitz.open(r"/abs/path/xxx.pdf") out = [] for i in range(doc.page_count): pix = doc[i].get_pixmap(dpi=150) pix.save("/tmp/_pg.png") res, _ = engine("/tmp/_pg.png") out.append( "\n===== Page %d =====\n" % (i + 1) + "\n".join(x[1] for x in (res or [])) ) open("/tmp/bagua_in_ocr.txt", "w", encoding="utf-8").write( "\n".join(out) ) ``` ### Technical Analysis The workflow installs third-party packages without pinned versions or hashes. The effective dependency set can therefore change after the Skill has been reviewed. A compromised upstream release, dependency takeover, or incompatible future version would execute during installation or import with the user's privileges. The OCR workflow also uses fixed names in the shared `/tmp` directory and intentionally leaves extracted data behind. On systems where `/tmp` is shared, another local user or process may pre-create a symbolic link at one of these paths, observe file contents, or cause the Skill to overwrite another writable target. The generated OCR text may contain complete proprietary or sensitive documents, making residual-file exposure significant. ### Attack Path Dependency path: 1. The Skill encounters a PDF requiring text extraction or OCR. 2. It instructs the agent to install the latest available package versions. 3. A compromised or unexpectedly modified package is downloaded. 4. Package installation or imp ...[truncated 873 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to reviewed versions and require package hashes. 2. Use a locked requirements file from a trusted package index or ship reviewed dependencies in a controlled runtime image. 3. Avoid runtime package installation during ordinary Skill use. 4. Create temporary files with `tempfile.TemporaryDirectory` or `NamedTemporaryFile` using restrictive permissions. 5. Open output files with exclusive-creation semantics and reject symbolic links. 6. Remove temporary images and extracted text in a `finally` block after processing. 7. If sandbox deletion is unavailable, use a private per-session directory inaccessible to other users and clearly notify the user about retained data. 8. Never recommend manually unpacking packages to bypass sandbox safeguards without equivalent integrity and lifecycle controls. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/forge-register.py:31
• Finding: Hard-coded personal email is transmitted by default during registration<![CDATA[ ## Vulnerability Details **File Location**: `scripts/forge-register.py:31-35, 140-156, 231-244` **Vulnerability Type**: Hard-coded personal information and implicit external disclosure **Risk Level**: Medium ### Vulnerable Code ```python SKILLS_BASE = Path.home() / ".workbuddy" / "skills" DEPLOY_DIR = ".deploy" CLOUD_OPEN_FILE = "cloud_open.json" CREATOR_EMAIL_HINT = "[e-mail]" ``` ```python def cmd_register(args, skill_dir: Path, slug: str, email: str, register_url: str): r = _post( register_url, "register", {"email": email, "slug": slug, "mode": "cloud"}, ) if not r.get("ok"): print(f"Registration failed: {r.get('error')}") return 1 print(f"Verification code sent to {email}") return 0 ``` ```python open_data = _load_open(skill_dir) email = args.email or open_data.get("email") or CREATOR_EMAIL_HINT register_url = _register_url_of(skill_dir) rc = dispatch[args.cmd]( args, skill_dir, slug, email, register_url ) ``` ### Technical Analysis If neither `--email` nor a previously stored email is available, the script silently selects a hard-coded personal email address. Registration, status, resend, and verification operations can consequently be directed to that identity without the current operator explicitly selecting or confirming it. The registration request transmits the email, Skill slug, and mode to the configured remote registration service. This is an unnecessary personal-data disclosure and can associate unrelated installations with the hard-coded address. ### Attack Path 1. A user runs the registration utility in a fresh Skill directory. 2. No `--email` argument or local registration record exists. 3. The script selects the embedded email automatically. 4. It prints the address but does not require confirmation. 5. The registration request sends the address and current Skill slug to the remote service. 6. Repeated use may trigger unsolicited verific ...[truncated 478 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the hard-coded email address from the distributed package. 2. Require `--email` or prompt interactively when no stored value exists. 3. Display the destination origin, email, and slug, then require explicit confirmation before transmission. 4. Store only the minimum registration state required and protect the resulting token file with owner-only permissions. 5. Avoid printing full email addresses in logs; mask them where practical. 6. Add a non-interactive failure mode so automated execution cannot silently fall back to a personal identity. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (61)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The specification describes scanning local directories, processing telemetry logs, posting anonymous signals to cloud endpoints, and maintaining multiple state files, all under the banner of content-to-methodology transformation. This discrepancy is risky because it masks ongoing data collection and network activity behind a benign-seeming analytical workflow.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The specification describes scanning local directories, processing telemetry logs, posting anonymous signals to cloud endpoints, and maintaining multiple state files, all under the banner of content-to-methodology transformation. This discrepancy is risky because it masks ongoing data collection and network activity behind a benign-seeming analytical workflow.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The specification describes scanning local directories, processing telemetry logs, posting anonymous signals to cloud endpoints, and maintaining multiple state files, all under the banner of content-to-methodology transformation. This discrepancy is risky because it masks ongoing data collection and network activity behind a benign-seeming analytical workflow.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The specification describes scanning local directories, processing telemetry logs, posting anonymous signals to cloud endpoints, and maintaining multiple state files, all under the banner of content-to-methodology transformation. This discrepancy is risky because it masks ongoing data collection and network activity behind a benign-seeming analytical workflow.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The specification describes scanning local directories, processing telemetry logs, posting anonymous signals to cloud endpoints, and maintaining multiple state files, all under the banner of content-to-methodology transformation. This discrepancy is risky because it masks ongoing data collection and network activity behind a benign-seeming analytical workflow.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The specification describes scanning local directories, processing telemetry logs, posting anonymous signals to cloud endpoints, and maintaining multiple state files, all under the banner of content-to-methodology transformation. This discrepancy is risky because it masks ongoing data collection and network activity behind a benign-seeming analytical workflow.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The specification describes scanning local directories, processing telemetry logs, posting anonymous signals to cloud endpoints, and maintaining multiple state files, all under the banner of content-to-methodology transformation. This discrepancy is risky because it masks ongoing data collection and network activity behind a benign-seeming analytical workflow.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The specification describes scanning local directories, processing telemetry logs, posting anonymous signals to cloud endpoints, and maintaining multiple state files, all under the banner of content-to-methodology transformation. This discrepancy is risky because it masks ongoing data collection and network activity behind a benign-seeming analytical workflow.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Creator registration and token-based cloud workflows are unrelated to normal user-facing methodology extraction and introduce identity, credential, and remote-service dependencies. Embedding these flows in the same skill broadens privileges and normalizes secret handling where users expect only document processing.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The skill claims it only produces methodology cards, yet it also instructs applying cloud-sourced proposals that modify local files and the skill itself. Pulling and applying remote changes from within a content-extraction skill creates a software supply-chain risk and can be abused to introduce unreviewed or malicious modifications into the local environment.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Mandatory session hooks, signal logging, cloud upload, and history pull are telemetry features beyond the extraction purpose and are especially concerning because they are framed as compulsory. Default-on operational tracking in a skill that may process sensitive notes, books, recordings, and links materially raises privacy and compliance risks.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The documentation claims writes occur only inside the skill directory, but other sections direct writes to home-directory libraries, opt-in files, backups, and deploy-token locations. False claims about write boundaries undermine informed consent and can lead users to expose or alter broader parts of their environment than intended.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file defines a broad telemetry and synchronization system that is materially unrelated to the stated purpose of extracting methodology from user-supplied content. This capability expansion increases the attack surface, enables covert collection of behavioral metadata, and creates a mismatch between user expectations and actual behavior, which is especially risky in a skill that processes sensitive user materials and links.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The file claims the skill only produces non-executable methodology cards, yet it embeds behavior and terminology from a skill-forging and runtime-monitoring system, including hooks, scripts, upload flows, and skill-file handling. This contradiction is dangerous because it obscures the skill's true behavior, making users and reviewers less likely to recognize telemetry and monitoring features that do not belong in the advertised capability set.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Hash/diff-based monitoring of local skill files is a surveillance capability unrelated to methodology extraction and can reveal user or operator behavior patterns about local development, review, or customization activity. Even if it avoids raw content capture, it still collects sensitive operational metadata and normalizes ongoing monitoring of local files beyond the skill's expected scope.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script’s behavior materially diverges from the declared skill purpose: instead of processing user-provided knowledge materials, it monitors local skill files and records edits. That hidden surveillance capability expands collection scope beyond user intent and can capture developer activity metadata across skills, which is security-relevant especially because it feeds a logging pipeline.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script enumerates the entire skills base directory and processes every skill containing references/signals.md, enabling cross-skill observation unrelated to the advertised methodology-extraction function. This creates an unnecessary surveillance surface and can reveal development activity, file names, and change patterns across unrelated skills without clear authorization.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The code implements cloud-side proposal administration rather than methodology extraction, which is a strong capability mismatch for this skill. That mismatch increases supply-chain risk because users or automated systems may install a content-processing skill that quietly includes remote-control and credential-reading behavior unrelated to its declared function.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This script is unrelated to the stated skill purpose and performs authenticated cloud administration actions using locally discovered creator credentials. It enumerates token locations outside the skill package and can submit approval or rejection decisions to a remote endpoint, creating a risky hidden capability that could be abused for unauthorized workflow actions or credential misuse.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence
• Finding: The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script implements cloud slug registration, email verification, and token issuance/storage workflows that are unrelated to the skill’s stated purpose of extracting methodologies from source materials. This expands the skill’s trust boundary to remote account management and credential handling, creating unnecessary exposure to external services and sensitive token material.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code discovers a remote registration endpoint from environment/config and uses it to perform creator email-based registration and token workflows, which are not justified by the manifest’s end-user purpose. In skill context, this hidden identity/account linkage is riskier because users expect content processing, not remote creator-account operations.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: Most of this file implements session state tracking, signal logging, usage metrics, and action-trace telemetry rather than the methodology-distillation behavior promised in the manifest. That mismatch is dangerous because it hides monitoring capability inside an unrelated skill, increasing the chance of unauthorized data collection, deceptive deployment, and operator misunderstanding about what code executes when the skill runs.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This section performs telemetry-oriented session startup behavior, including upload and download of signals, which materially exceeds the skill's stated purpose of methodology extraction from user materials. Hidden stateful telemetry in a content-processing skill creates a trust and consent boundary issue: users invoking summarization/extraction may unknowingly trigger cross-session logging and remote sync behaviors unrelated to the advertised function.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This script performs cross-skill discovery, state bootstrapping, and cloud telemetry upload across the entire skills base, which is materially unrelated to the declared purpose of extracting reusable methodologies from user-provided materials. That mismatch is dangerous because it introduces hidden data-collection and exfiltration behavior under the cover of an unrelated skill, reducing transparency and making unauthorized telemetry harder for users and reviewers to detect.

Static analysis

No suspicious patterns detected.