Security audit

Curiosity Engine

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly transparent, but it broadly encourages tool-driven exploration including shell execution and optional memory persistence for a general reasoning aid.

Install only if you want an agent to spend extra effort exploring uncertainty. Keep shell execution and file reading gated by normal user approval or sandbox policy, and opt into memory only when you are comfortable retaining future-question context across sessions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description says this skill enhances an agent's reasoning by activating during certain task conditions and injecting structured curiosity behaviors into the reasoning process. The supplied code does not alter agent behavior, reasoning, triggers, or tool use at runtime. Instead, it analyzes already-produced text and scores it across curiosity dimensions like question generation, assumption challenging, and confidence calibration. This is a materially different primary purpose: evaluation/measurement rather than behavior augmentation. While the thematic domain of 'curiosity' is aligned, the implemented capability is an assessor script, not a reasoning-enhancement skill. Additionally, the code reads from a file or stdin, which implies resource access not reflected in the declared permissions.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill explicitly directs use of tools such as read, web_fetch, web_search, and exec, but the manifest does not declare an allowed tool scope or permissions boundary. That mismatch creates ambiguity for the host and reviewers, increasing the chance the skill is granted broader capabilities than intended or uses file access without explicit approval.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation conditions are broad enough to trigger on common phrases like 'explore' or 'dig deeper,' causing the skill to activate in many ordinary interactions. In context, that increases the chance of unnecessary tool use, deeper probing, and escalation into read/exec behaviors when a simpler response would have been safer.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Instructing a general reasoning-enhancement skill to use exec as an exploration tool is dangerous because it normalizes code execution for loosely scoped, curiosity-driven tasks. That can lead agents to run untrusted commands or process attacker-influenced inputs during exploration, turning benign prompts into command-execution opportunities.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The recommendation to persist open threads in a memory file introduces unnecessary data retention for a skill whose primary function is reasoning style enhancement. Persisting exploratory questions can capture sensitive user context across sessions and broaden the privacy and prompt-injection surface without a strong functional need.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.