Security audit

adversarial-robustness

Security checks for vulnerabilities and agentic risk

Overview

This local robustness tool also keeps plain-text history and preferences and tells agents to update its own instructions, so it needs review before installation.

Install only if you are comfortable with the skill keeping local plain-text evaluation history, notes, and preferences. Review or disable learner.py usage if you need stateless runs, and do not allow automatic edits to SKILL.md without human review.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill documentation describes file-writing behavior via `learner.py` and persistence to `learned_patterns.json`, yet no corresponding permission declaration is present. Undeclared write capability undermines least-privilege expectations and can surprise operators or downstream policy engines that rely on manifest permissions for trust decisions.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The stated purpose is a local robustness evaluator, but the skill also documents a generalized self-learning and preference/history persistence subsystem that records usage, failures, notes, and preferences. This mismatch is dangerous because users may invoke the skill expecting transient analysis while it silently accumulates operational data and expands behavior beyond the advertised scope.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The manifest markets the skill as a pure local robustness tool, but the body describes persistent self-learning state and even modifying skill documentation. Self-modifying or stateful behavior changes the trust model, increases attack surface, and can cause unexpected drift or contamination of future runs.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The documented rule to 'write back' into `SKILL.md` is not necessary for adversarial robustness testing and creates an unnecessary integrity risk. If abused or triggered incorrectly, it could alter safety guidance, expand scope, or persist adversarial content into the skill's own instructions.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The file is a generic cross-skill telemetry/learning component that records usage, errors, and preferences for arbitrary skills, which is materially broader than the advertised adversarial-robustness function. That scope mismatch is dangerous because it introduces hidden persistence and behavioral profiling capability that can be reused across skills without clear necessity, violating least privilege and creating an unexpected data-collection surface.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code persistently stores user preferences, notes, error history, and recent operations in learned_patterns.json without any minimization, retention control, or purpose limitation tied to adversarial testing. This creates a local surveillance/logging mechanism that may capture sensitive workflow details and can be repurposed by other components or exposed through filesystem access.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill documents persistent recording of user preferences and evaluation history without any prominent retention, privacy, or consent warning. This can lead to unanticipated storage of sensitive prompts, operational notes, or decision outcomes, creating privacy and compliance risk disproportionate to the core task.

Ssd 3

Medium

Confidence: 91% confidence
Finding: The skill explicitly instructs persistent logging of preferences, failures, notes, and assessment history in plain language, which creates a durable data-retention and leakage risk beyond robustness evaluation. Plain-text accumulation of operational context can expose sensitive workflows or user information if the local environment is shared, backed up, or later repurposed.

Static analysis

No suspicious patterns detected.