Security audit

active-causal-experiment

Security checks for vulnerabilities and agentic risk

Overview

The causal experiment tool itself is coherent, but the package adds an unrelated persistent self-learning logger that records usage history, errors, notes, and preferences without clear opt-in or retention controls.

Review this before installing if you do not want a skill to keep local memory about how it is used. The causal experiment script appears locally scoped, but the learner should be disabled, removed, or made explicit opt-in with a clear way to inspect and delete learned_patterns.json.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill documents file-writing behavior via the learning module (`learned_patterns.json`) but does not declare corresponding permissions. Undeclared write capability undermines least-privilege expectations and can lead to unreviewed persistence of data or modification of local skill files.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill’s stated purpose is causal experiment design, but the documentation adds a generic self-learning subsystem that records usage history, errors, and preferences across sessions. This is a scope expansion that introduces data collection and retention functionality unrelated to the core task, increasing privacy and abuse risk.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: Persisting user preferences and cross-session behavioral history is not necessary for selecting informative causal interventions. Collecting such data without strong justification creates avoidable privacy risk and a larger attack surface if the stored JSON is exposed, reused, or repurposed.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: This file implements a generic cross-skill telemetry and self-learning component that is unrelated to the stated purpose of active causal experiment design. Because it can be invoked by arbitrary skills and persists usage history, errors, notes, and preferences under a shared skills directory, it expands data collection scope and creates an unnecessary surveillance/persistence surface that could expose sensitive operational context across skills.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The code persistently records capability usage, failures, error types, free-form notes, and user preferences without any clear necessity tied to causal experiment design. Free-form notes and error metadata can easily capture sensitive prompts, internal workflow details, or identifiers, creating a privacy and data-retention risk if the local filesystem is accessed by other users, tools, or compromised processes.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill does not clearly disclose in its main description that it stores persistent usage history and user preferences in a local JSON file. Insufficient transparency prevents informed use and can cause sensitive behavioral or preference data to be retained unexpectedly.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The module writes preferences and notes directly to disk in a predictable JSON file without transparent disclosure, consent, or protective controls. Hidden persistence is dangerous because users may provide data assuming it is ephemeral, while the stored content can later be inspected, exfiltrated, or reused outside the user's expectations.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The documented storage of preferences, error text, notes, and usage history in a local memory file creates a direct data retention risk. Free-form notes and error fields can easily capture sensitive natural-language content, which may later be disclosed to other processes, users, or future runs without appropriate controls.

Static analysis

No suspicious patterns detected.