Security audit

Pa Eval

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local PA performance evaluator, but it enables automatic persistent logging of feedback and behavioral judgments without clear opt-in, review, or retention controls.

Review before installing if you do not want the agent to keep persistent performance notes. Use it only with explicit schedules and clear consent, and periodically review or delete the .learnings/eval records if they contain sensitive feedback.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The skill description uses broad usage criteria such as general performance review, feedback analysis, and assessing response quality, which can match ordinary conversation and cause unintended activation. Unexpected invocation of an evaluative skill increases the chance of silent data collection and persistence of sensitive interpersonal feedback without clear user intent.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The trigger rules include automatic weekly runs and activation on vague phrases like 'how am I doing?', which are underspecified and likely to fire during routine conversation. Because the skill also writes evaluation artifacts and logs feedback, accidental activation can lead to unwanted profiling and persistent storage of behavioral data.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs saving evaluation files containing scores, owner feedback, complaints, and failures to a persistent local path, but provides no privacy notice, retention guidance, or access-control expectations. This creates risk of storing sensitive workplace or relationship performance data in a way users may not expect and that other local processes or users could access.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The skill directs automatic logging of owner reactions, corrections, language cues, repeated questions, and inferred behavior gaps immediately when detected, without user-facing disclosure or consent. This is more dangerous than ordinary note-taking because it enables continuous behavioral monitoring and durable profiling based on implicit signals and inferences, including potentially inaccurate negative judgments.

Natural-Language Policy Violations

Low

Confidence: 77% confidence
Finding: The feedback signal list explicitly encodes Hebrew and English phrases as detection cues, but the document does not say that language handling is configurable or based on user preference. This can create a locale-policy issue by implicitly privileging specific languages without documented opt-in or justification.

Static analysis

No suspicious patterns detected.