Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
- Without declared permissions the skill's intent is opaque and cannot be validated.
Security audit
notification-triage
Security checks for vulnerabilities and agentic risk
Overview
This skill is a local notification filter that persistently stores triage state, with some documentation inconsistencies but no evidence of hidden exfiltration, credential use, or unrelated system access.
Install only if local persistence of notification content and metadata is acceptable. Review rules and dropped.json periodically, use --force for test classifications to avoid creating lasting source rules, and be careful with --rules clear, --rules remove, --seen --all, --send, and --digest because several mutate or clear local triage state without an enforced --force prompt.
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
- Most of the description matches the implementation: first-time classifications do create persistent per-source rules unless --force is set, ignored notifications are dropped and logged to dropped.json, digest clearing affects digest.json rather than batch.json, and writes use a temp-file-plus-rename atomic pattern. However, the description explicitly states that destructive operations require --force, while the code does not enforce --force for destructive actions such as --rules clear, --rules remove, or --seen --all. That is a concrete behavioral mismatch. Additionally, the code includes notable capabilities for seen tracking, status reporting, and rule management that are not reflected in the declared description. Because the description makes a specific safety claim that the code violates, this should be flagged as a mismatch.
Description-Behavior Mismatch
Medium
- Confidence
- 83% confidence
- Finding
- The manifest explicitly warns that digest operations clear `digest.json`, not `batch.json`. The README describes `digest.json` only as 'Digest entries awaiting batch', which implies digest generation operates over digest-specific queued entries rather than the manifest’s unusual clearing behavior. This creates a semantic mismatch between the skill’s claimed behavior in manifest context and its documented behavior.
Intent-Code Divergence
Low
- Confidence
- 89% confidence
- Finding
- The README’s classification algorithm says urgent keywords are worth +2 and urgent requires score ≥ 3, but the example `classifyMessage('server down', 'monitor')` returns `{ level: 'urgent', score: 2 }`. That example contradicts the documented algorithm because 'server down' appears to contain at least one urgent keyword yet still shows an urgent result below the stated threshold. This is an intent/documentation contradiction rather than a mere omission.
Intent-Code Divergence
Medium
- Confidence
- 95% confidence
- Finding
- The header comment states that '--force' is 'required for destructive ops', which communicates a safety guard for state-changing actions. In the CLI implementation, '--rules remove', '--rules clear', and '--send'/'flush' execute directly with no force check, so the inline documentation materially overstates the protection actually enforced.
Description-Behavior Mismatch
Medium
- Confidence
- 91% confidence
- Finding
- The manifest describes a working digest feature with specific clearing semantics, implying notifications are accumulated into digest storage. In the code, generateDigest reads and clears digest.json, but no path ever adds entries to DIGEST_FILE, so the advertised digest behavior is effectively absent and does not match the stated functionality.
Missing User Warnings
Low
- Confidence
- 84% confidence
- Finding
- This markdown file documents that notification data is stored under `memory/notification-triage/`, including pending queues, seen IDs, rules, and digest entries. Because notifications can contain sensitive operational or personal content, the skill description should clearly warn users that message data is persisted locally and may remain on disk until cleared.
Missing User Warnings
Medium
- Confidence
- 87% confidence
- Finding
- This code stores notification messages and sources to batch state on disk, and similar persistence also occurs for dropped and seen records elsewhere in the file. Although the header documents atomic writes and file locations, there is no user-facing warning at the operation site that notification content will be retained locally, which can affect user data/privacy.
Missing User Warnings
Medium
- Confidence
- 96% confidence
- Finding
- The clear-all operation overwrites the rules file with an empty object immediately, deleting all configured rules. The file header says destructive operations require --force, but this function and its CLI path execute without any confirmation prompt or force check, so users may not get adequate warning before irreversible state loss.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Content
Mitigation: Review `dropped.json` regularly. Any source in `rules.json` at `ignore` level should be re-evaluated periodically. ### 3. Destructive Operations Require `--force` The following operations are silently destructive — they mutate or clear state without confirmation. To prevent accidental data loss, they require the `--force` flag: | Operation | Effect | Force Required? | |-----------|--------|-----------------|
- Confidence
- 75% confidence
- Finding
- Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Persistent Context Injection
Medium
- Category
- Memory Poisoning
- Content
1. **Source-specific rules first** — If a rule exists for the source, use it immediately 2. **Keyword scoring** — Each urgent keyword +2, each batch keyword -1, time-sensitive +1 3. **Thresholds** — Score ≥ 3 = urgent, Score ≥ 1 = batch, else ignore 4. **Auto-rule creation** — First classification for a source saves its level as a persistent rule ---
- Confidence
- 80% confidence
- Finding
- Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.
Memory Manipulation
High
- Category
- Memory Poisoning
- Content
Mitigation: Review `dropped.json` regularly. Any source in `rules.json` at `ignore` level should be re-evaluated periodically. ### 3. Destructive Operations Require `--force` The following operations are silently destructive — they mutate or clear state without confirmation. To prevent accidental data loss, they require the `--force` flag: | Operation | Effect | Force Required? | |-----------|--------|-----------------|
- Confidence
- 80% confidence
- Finding
- Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Memory Manipulation
High
- Category
- Memory Poisoning
- Content
- `dropped.json` — silently-dropped notifications (**capped at 1000 entries**) - `digest.json` — digest store (**capped at 1000 entries**) All JSON writes are **atomic** (temp + rename) — a crash mid-write cannot corrupt the state files. Clear state by deleting files under `memory/notification-triage/`. ### 5. Digest vs. Batch — They're Separate `--digest` clears the `digest.json` store. It does **NOT** clear the `batch.json` queue. To clear the batch queue, flush with `--send` (all pending) or mark items as seen individually.
- Confidence
- 80% confidence
- Finding
- Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Static analysis
No suspicious patterns detected.