Security audit

Metacognitive Protocol Lite

Security checks for vulnerabilities and agentic risk

Overview

This is mainly an instructional metacognition prompt/framework with auxiliary marketing files, and I found no hidden execution, credential access, network behavior, persistence, or destructive capability.

This skill is reasonable to install as a prompt-style reliability framework, but treat its 'execute on best interpretation' guidance as low-risk-task guidance only. Require explicit confirmation before deletion, purchases, account changes, public posting, credential use, or other irreversible/sensitive actions. The included PPT script should be run only if you want a local presentation file and after changing its output path.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: There is a clear mismatch between the declared purpose and the actual code behavior. The description claims the skill provides an operational AI-agent protocol to reduce hallucinations, fake completions, and task drift. However, the supplied code does not implement intent decoding, difficulty assessment, execution monitoring, delivery validation, or any reusable model-agnostic agent framework. Instead, it only builds a presentation deck describing and promoting such a protocol. While the presentation content references the declared concept, the code's actual primary function is document generation/marketing asset creation, not agent behavior control or reliability enhancement.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The manifest describes a lightweight protocol that adds intent decoding, difficulty assessment, boundary declaration, execution monitoring, and delivery validation to LLM agents. This file contains only presentation-building logic and hardcoded slide copy, with no agent-facing protocol implementation, validation logic, or reusable framework behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill encourages the agent to infer implicit user needs, which can cause it to take actions the user did not explicitly authorize. In security-sensitive or transactional contexts, this increases the risk of unintended operations, overreach, or acting on a mistaken interpretation without adequate confirmation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The ambiguity protocol explicitly tells the agent to choose its best interpretation and execute first, then offer alternatives. That pattern is unsafe when requests could be irreversible, sensitive, or costly, because the harmful action may already have occurred before the ambiguity is corrected.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 217)May include surrounding context.
md
Before sending, verify: - **Accuracy**: Every claim is either from verified knowledge or explicitly marked as uncertain - **Completeness**: All parts of the user's request are addressed - **Actionability**: The user can act on this output without asking follow-up questions - **Honesty**: No fabricated data, no inflated confidence, no hidden failures ---

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · article_why_your_ai_agent_fails.md (reported line 104)May include surrounding context.
md
This catches drift, incomplete steps, and emerging problems *during* execution — not at delivery. **Without protocol:** Agent runs to completion without checking. Errors compound. **With protocol:** Errors caught at step 3, not at step 10. ### Stage 5: Delivery Validation

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The module documentation states that the file's purpose is to create a presentation, while the skill manifest presents the skill as a framework that improves LLM agent behavior. This is an active divergence between the code documentation and the declared skill intent, indicating the shipped code serves a different purpose than the skill claims.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The article directs users to follow updates on a specific platform ('Moltbook') and ends with provider branding that includes Chinese-language naming ('StepFun (阶跃星辰)') without any opt-in or alternative locale/language path. Under the language/locale policy rule, content that assumes a fixed locale or platform ecosystem without user choice can be a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script writes output to a hard-coded absolute path on the local filesystem without validating that the destination is safe, portable, or user-approved. In an automated agent or shared execution environment, this can cause unintended file creation, overwrite failures, information leakage about local paths, or writes into sensitive/workspace locations if adapted carelessly.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: SKILL.md:226