Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 4. Run `node scripts/rebuild_index.mjs` after article metadata or assessment changes.
Security audit
readworthy
Security checks for vulnerabilities and agentic risk
Overview
This skill keeps a local reading profile and article history for its stated recommendation purpose, with disclosed local files and maintenance scripts.
Install only if you are comfortable with the agent keeping a persistent local reading profile, article records, raw feedback events, insights, and timestamped backups under the configured Readworthy state directory. Use READWORTHY_STATE_DIR if you want a specific storage location, and periodically inspect or delete that directory if you do not want long-term history retained.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 5. Run `node scripts/validate_state_v2.mjs` after all writes.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 78% confidence
- Finding
The skill instructs use of environment variables such as READWORTHY_STATE_DIR and CODEX_HOME to resolve persistent state, but it does not declare an explicit tool scope or permissions model. That creates a mismatch between declared capability boundaries and actual behavior, increasing the risk of unintended environment access or deployment in contexts where operators did not expect stateful local I/O.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill persistently stores private reading profiles, article history, feedback, events, and backups, but the user-facing skill description does not provide an explicit warning about retention, privacy implications, or how long sensitive preference data will remain on disk. This is dangerous because users may share links, private documents, or corrective feedback without understanding that detailed behavioral data and audit history will be retained locally and backed up.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Creating labeled, timestamped backups of all local state is an operational maintenance function rather than an obvious requirement for deciding whether content is worth reading or learning from feedback. The manifest mentions maintaining a private local profile, but not snapshotting or duplicating all stored state into backup directories.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest describes assessing content, recommending what to read, and maintaining a private local reading profile with feedback-based learning. This script creates a timestamped backup directory and copies the manifest, profile, indexes, insights, events, and article data into it, which is a separate state-management/archival capability not reflected in the skill description.
- Content