Security audit

Proprioception

Security checks for vulnerabilities and agentic risk

Overview

This skill is local and not overtly malicious, but it silently intercepts every turn and can change or delay agent responses based on broad heuristics while handling sensitive conversation text.

Install only if you want an always-on, local response-quality monitor that may interrupt or reshape answers. Avoid using it with sensitive conversations unless the host provides opt-in controls, limits retained history, and changes the engine input method away from command-line arguments.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:207
Finding: Always-On Skill Instructions Override the Agent's Primary Response Behavior
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:215
Finding: Sensitive Conversation Content Is Passed Through Process Command-Line Arguments
Content: View full analysis
--current-response --turn-number [--prior-signals ] [--dashboard]" ); process.exit(1); } const rootIntent = args["root-intent"] || ""; const currentResponse = args["current-response"] || ""; const turnNumber = parseInt(args["turn-number"] || "1", 10); const priorSignals = args["prior-signals"] ? JSON.parse(args["prior-signals"]) : []; ``` ### Technical Analysis The prescribed invocation places the user's root intent, the complete drafted response, and serialized prior-session telemetry in the child process's argument vector. Command-line arguments are not an appropriate transport for potentially confidential conversation content. Depending on the host operating system and process isolation configuration, arguments can be exposed through process inspection interfaces, monitoring agents, diagnostic tooling, audit logs, crash repor ...[truncated 2364 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The description presents a comprehensive situational/self-awareness system covering goal alignment, confidence boundaries, conversation trajectory, and output quality. The code only examines a single response string for lexical markers of certainty/uncertainty and returns a confidence score with per-sentence zones. While this partially matches the 'confidence boundaries' aspect, it does not implement the broader claimed capabilities, making the declared purpose materially overstated relative to actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The description is significantly broader and more conceptual than the code's actual behavior. The code only analyzes the agent's current response against prior responses to detect three anti-patterns: repetition, tangential drift, and declining lexical diversity, then derives a drift score and simple arc phase. It does not inspect user goals, model confidence, knowledge limits, or comprehensive output quality, all of which are central to the declared 'self-spatial awareness' capability. While conversation trajectory is partially represented by drift scoring and arc-phase estimation, the implementation is materially narrower than the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The code is narrowly focused on scoring response/session quality from response text and prior signal history. It evaluates relevance, precision, novelty, efficiency, and derives a trend such as improving or declining. While this overlaps slightly with the declared mention of conversation trajectory and output quality, it does not implement core claimed capabilities like awareness of the user's goal alignment, the agent's confidence boundaries, or a broader 'self-spatial awareness' model. The primary purpose is materially different and much narrower than the description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code chunk only provides low-level string and token analysis helpers. While such utilities could support a larger system related to conversation analysis, this code itself does not implement the declared capability of real-time self-spatial awareness, confidence sensing, goal-relative positioning, or quality monitoring. Its primary purpose is generic text utility/NLP preprocessing, which is materially different from the ambitious declared description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill instructs the agent to run silent background analysis on every conversation turn without any user-facing disclosure. Even if processing is local, continuously deriving metadata from all user content without notice can violate privacy expectations and create hidden profiling of user behavior, intent, and confidence-sensitive content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill describes appending proprioceptive readings to session signal history, which amounts to retaining conversation-derived behavioral metadata across turns without a stated retention notice or policy. This can expose sensitive inferred data about the user or session if logs are later inspected, persisted, or reused beyond the immediate interaction.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documented 'Data Flywheel Potential' goes beyond transient self-awareness for a single session and explicitly proposes aggregating telemetry across thousands of sessions to build model/domain reliability maps and conversation behavior datasets. Even though this is framed as product or research value, it creates a clear privacy and scope-expansion risk because session-level behavioral metadata can become sensitive when retained, correlated, or repurposed beyond the user-facing function of the skill.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.