Elen: Epistemic Decision Tracker

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:27 AM UTC
• Version: 1.0.1

Overview

The skill is coherent for maintaining a decision log, but it requires broad persistent agent workflow changes through an external MCP package with limited scoping and user-control guidance.

Install only if you trust the `@learningnodes/elen-mcp@0.1.1` npm package and are comfortable with agents storing technical, security, design, and product decisions in a persistent local decision graph. Review the MCP server source and dependencies, run it with minimal filesystem and environment access, avoid storing secrets or sensitive vulnerability details, and require explicit user review before committing decisions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:16
• Finding: Automatic Retrieval and Execution of an Unreviewed npm Package## Vulnerability Details **File Location**: `SKILL.md`, lines 16-25 **Vulnerability Type**: Supply-chain risk caused by automatic third-party package execution **Risk Level**: High ### Vulnerable Code ```markdown **Installation Requirement:** Before this skill will work, you or your agent must configure the Elen MCP server in your IDE/Agent settings (e.g., Cursor, Claude, Windsurf): ```json { "mcpServers": { "elen": { "command": "npx", "args": ["-y", "@learningnodes/elen-mcp@0.1.1"] } } } ``` ``` ### Technical Analysis The prescribed configuration invokes `npx` with the `-y` option. This allows npm to retrieve and execute `@learningnodes/elen-mcp@0.1.1` without interactive confirmation. Pinning the package to version `0.1.1` limits version drift, but the project does not include the package source, a dependency lockfile, integrity hashes, a trusted-source declaration, or other provenance controls. The package and its transitive dependencies therefore remain outside the reviewed project and cannot be verified from the available artifact. If the named package, its publisher account, the npm distribution channel, or a transitive dependency were compromised, initialization of the MCP server could execute attacker-controlled code with the permissions of the IDE or agent process. ### Attack Path 1. An attacker compromises the referenced npm package, its publisher account, or one of its transitive dependencies. 2. A user or agent follows the documented configuration. 3. The IDE launches `npx -y @learningnodes/elen-mcp@0.1.1`. 4. `npx` retrieves the package and dependencies from the configured npm registry without requesting confirmation. 5. Package installation hooks or runtime entry points execute attacker-controlled code. 6. That code operates with the local permissions and accessible environment of the IDE or agent process. ### Impact Assessment A compromised dependency co ...[truncated 519 chars]
• Remediation: ## Remediation Suggestions 1. Vendor or otherwise include the MCP server implementation in a reviewable source repository. 2. Use an audited lockfile that pins all transitive dependencies. 3. Verify package provenance and publish the expected registry, source repository, maintainer identity, and package integrity hashes. 4. Avoid automatic `npx -y` retrieval during normal skill use. Require an explicit, separately reviewed installation step. 5. Disable or carefully review dependency installation scripts where operationally possible. 6. Run the MCP server in a sandbox with narrowly scoped filesystem access, a minimal environment, and restricted network access. 7. Do not expose unrelated credentials, tokens, or sensitive environment variables to the MCP process. 8. Establish a dependency update and vulnerability-monitoring process before changing the pinned package version.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:8
• Finding: Mandatory Redirection of Agent Decisions Through Persistent External State## Vulnerability Details **File Location**: `SKILL.md`, lines 8-9, 27-33, and 44-46 **Vulnerability Type**: Agent workflow and instruction hijacking **Risk Level**: Medium ### Vulnerable Code ```markdown > [!IMPORTANT] > This skill establishes the baseline rules for reasoning within the Learning Nodes stack. You **MUST** use the Elen MCP server to document your epistemic decisions. Doing so ensures that choices are version-controlled, preserved, and searchable. ``` ```markdown Whenever you make a meaningful technical, design, security, or product decision (e.g., choosing a specific framework, styling a UX component, structuring an API endpoint, or dropping a feature), you should record it using the available MCP tools provided by the server. ## 2. When to Use the Elen MCP - **Before Action**: Use `mcp_elen_elen_suggest` and `mcp_elen_elen_get_competency` to query if a decision has already been formulated for the topic you are working on. - **During the Task**: When you formulate a new plan or solve a structural issue, use `mcp_elen_elen_commit` to save the decision to the network. - **When Fixing Bugs**: If you resolve a bug and it warrants a systemic change or constraint update, commit a new decision and reference the old one (or use `mcp_elen_elen_supersede` if completely overruling). ``` ```markdown ## 4. Avoiding Action Without Context Never implement sweeping, codebase-wide changes without first verifying prior related artifacts in the decision network. The goal is to create **visible reasoning**, eliminating tribal knowledge and undocumented assumptions from the loop. ``` ### Technical Analysis The skill declares mandatory baseline rules that redirect technical, design, security, and product decisions through an MCP-managed decision network. It instructs the agent to retrieve persistent records before acting and to commit newly generated reasoning during tasks. These instructions are not limited to a na ...[truncated 2200 chars]
• Remediation: ## Remediation Suggestions 1. Make MCP integration opt-in rather than mandatory and require explicit user authorization before reading or writing persistent records. 2. Limit the workflow to tasks for which decision-network integration was specifically requested. 3. State explicitly that system instructions, safety requirements, current user instructions, and repository-specific policies take precedence over stored decisions. 4. Treat all retrieved records as untrusted context that must be validated against the current task and codebase. 5. Prohibit storage of credentials, tokens, personal data, exploit details, confidential source material, and other sensitive information. 6. Add project, repository, user, and task isolation so decisions cannot unintentionally cross trust boundaries. 7. Implement access controls, audit logging, record provenance, integrity protection, expiration, correction, and deletion mechanisms. 8. Present proposed decision records to the user for review before committing them. 9. Permit agents to proceed safely when the MCP server is unavailable or when persistence is inappropriate.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.