Security audit

analogical-reasoning

Security checks for vulnerabilities and agentic risk

Overview

The skill’s analogy engine is local and simple, but it also adds persistent usage memory and self-modification instructions that are broader than the stated analogy purpose.

Review before installing. The analogy tool itself is local and does not appear to exfiltrate data, but the bundled learner persists usage history, errors, notes, and preferences in the skill directory and encourages future skill-file edits. Install only if you are comfortable with that local memory behavior, and avoid recording sensitive prompts or personal information in learner notes or preferences.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares no permissions, but its documented behavior includes writing a persistent local file (`learned_patterns.json`) and instructing users to run a learner that records usage data. That creates a real integrity and privacy risk because operators and downstream tooling cannot accurately understand or constrain the skill's data-handling behavior from the manifest alone.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The stated purpose is a zero-dependency local analogy engine, but the skill also adds a persistent self-learning subsystem that records usage history, errors, and user preferences. This mismatch is dangerous because users may invoke the skill expecting pure stateless reasoning while it silently accumulates data, expanding both privacy exposure and the attack surface beyond what was disclosed.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The documentation expands the skill from analogical reasoning into persistent self-learning and memory, which is materially different behavior from the core advertised function. Undocumented stateful behavior is risky because it can retain sensitive prompts or operational metadata and produce non-obvious side effects across runs.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Persistently collecting user preferences and usage history is not necessary for performing one-off analogical reasoning, so it introduces avoidable privacy and data minimization issues. Even if stored locally, such records can reveal sensitive workflows, interests, or operational patterns if the host is shared or later compromised.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The file clearly implements a generic telemetry and self-improvement component for arbitrary skills rather than analogical reasoning logic. This mismatch is dangerous because it introduces undeclared cross-skill data collection capabilities into a package whose stated purpose would not reasonably require persistent usage tracking, reducing transparency and increasing the risk of privacy abuse or stealthy behavior.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The code persists capability history, error notes, and user preferences to disk, which can capture sensitive behavioral or personal information without any minimization, consent, or retention controls. In the context of an analogical reasoning skill, this collection is not functionally necessary, so the hidden persistence is more suspicious and expands the privacy attack surface.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The docstring advertises the module as usable by any WorkBuddy skill, contradicting the package's claimed role as a single analogical-reasoning skill. Such scope mismatch is a supply-chain red flag because it can hide platform-wide collection or behavioral influence under the cover of a narrowly described package.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill states that usage data and preferences are automatically persisted, but it provides no warning about privacy, retention, or the consequences of writing user-related memory to disk. This is dangerous because users may unknowingly expose personal or sensitive operational information through routine use.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs storing user preferences and ongoing usage history in a local memory file, creating a durable natural-language data store that may contain sensitive information. Such files are often weakly protected, easy to overlook, and can leak across sessions, users, backups, or support bundles.

Static analysis

No suspicious patterns detected.