Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
- Without declared permissions the skill's intent is opaque and cannot be validated.
Security audit
behavior-observability
Security checks for vulnerabilities and agentic risk
Overview
The skill is not malicious, but it mixes observability with persistent preference-learning and self-modification guidance that users should review before installing.
Install only if you are comfortable with a local skill retaining preference and usage/error notes in learned_patterns.json. Review or clear that file regularly, avoid logging secrets or sensitive payloads, and treat the advertised audit-log persistence as incomplete until the logger is fixed.
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
- 存在明显不匹配。首先，description 聚焦于“行为可观测性/审计日志”，而实际代码除了 observability.py 外，还包含 learner.py，这个模块实现的是独立的技能学习与偏好管理功能，属于未声明的额外能力。其次，description 明确提到“结构化事件落盘”，但 observability.py 的 EventLog 仅将事件保存在进程内存列表中，CLI 每次启动都会新建空日志，query/metrics/timeline 无法跨运行保留数据，因此与“落盘、可信完整行为轨迹、事后审计”这一核心承诺不符。虽然 observability.py 的查询、错误率、平均时延、P95 和时间线等方向与描述部分一致，但整体上代码的主行为与声明存在实质偏差，并包含未声明的学习/偏好/复盘能力。
Description-Behavior Mismatch
Medium
- Confidence
- 97% confidence
- Finding
- The manifest's primary description limits the skill to structured event logging, querying, metrics aggregation, and timeline replay for agent behavior. However, the later documentation claims an embedded learner that records capability usage, user preferences, error patterns, and performs reflective improvement, which is a broader adaptive-memory function not described as part of observability.
Context-Inappropriate Capability
Medium
- Confidence
- 95% confidence
- Finding
- Persisting user preferences, capability frequencies, and improvement suggestions is not an obvious requirement for a behavior-observability skill whose stated role is audit logging and metrics. This capability creates a broader profile/memory function that is not justified by the declared purpose of structured tracing and replay.
Description-Behavior Mismatch
High
- Confidence
- 96% confidence
- Finding
- The manifest describes a behavior-observability skill whose role is to emit structured audit events, support querying/metrics, and enable timeline replay for post-hoc analysis. This file instead implements a cross-skill 'self-evolution' learner that stores user preferences, tracks capability success/failure patterns, and generates optimization/reflection suggestions for arbitrary skills, which is a materially different purpose than audit logging/observability.
Context-Inappropriate Capability
Medium
- Confidence
- 92% confidence
- Finding
- Observability for agent behavior reasonably includes recording operational events and computing metrics, but persisting arbitrary user preferences is a separate personalization capability. The file explicitly records key/value user preferences and exposes a CLI to write them, which is not supported by the manifest’s stated scope of audit logs, tracing, and behavior replay.
Context-Inappropriate Capability
Medium
- Confidence
- 89% confidence
- Finding
- The manifest positions the skill as a passive observability layer complementary to decision and review systems, primarily for auditability and metrics. The self_reflect logic turns logged data into active optimization guidance about adding prechecks, changing skill documentation, and pruning capabilities, which is a learning/adaptation capability rather than straightforward observability.
Description-Behavior Mismatch
Medium
- Confidence
- 97% confidence
- Finding
- The manifest/docstring describes structured events being '落盘' for auditability, multi-dimensional querying, metrics, and timeline replay. In the actual code, EventLog only stores events in `self.events` in memory (L31-L32, L48), and `main()` creates a fresh EventLog on each invocation (L144), so emitted events are lost immediately after process exit and later query/metrics/timeline operations cannot observe prior runs.
Intent-Code Divergence
Medium
- Confidence
- 92% confidence
- Finding
- The usage examples advertise `--emit`, `--query`, `--metrics`, and `--timeline` as meaningful CLI operations over the behavior log. However, because `--query` has a default value of `{}` (L136) and is checked before `--metrics`/`--timeline` (L153-L162), a normal invocation without `--emit` prints `log.query({})` from a brand-new empty EventLog (L144-L155), making metrics/timeline effectively unreachable unless `--query` is overridden and never operating on prior emitted data.
Vague Triggers
Medium
- Confidence
- 94% confidence
- Finding
- This is a manifest/markdown file, so vague-trigger review applies. The listed trigger phrases mix specific terms with broad generic words such as "trace" and "agent 监控", and the file provides no negative examples or activation boundaries to clarify when the skill should or should not activate.
Missing User Warnings
Medium
- Confidence
- 92% confidence
- Finding
- For markdown files, warnings are required when behavior may affect user data or privacy. The description says every action, tool call, LLM call, decision, and review result is written to structured logs, and later sections state that user preferences are stored in `learned_patterns.json`, but the document does not clearly warn users about retention of potentially sensitive behavioral data.
Missing User Warnings
Medium
- Confidence
- 90% confidence
- Finding
- The markdown explicitly says `learned_patterns.json` records user preferences and that future runs will apply them directly. This affects user data/privacy, yet the file does not provide a warning, consent note, or guidance on reviewing/removing stored preferences.
Natural-Language Policy Violations
Medium
- Confidence
- 95% confidence
- Finding
- This file’s user-facing natural language, including the module description and command usage, is exclusively in Chinese. The policy for natural-language violations applies to all file types, and there is no indication that users can opt into another language or that this locale restriction is required for a region-specific purpose.
Natural-Language Policy Violations
Medium
- Confidence
- 97% confidence
- Finding
- This Python file contains natural-language instructions, capability descriptions, and usage examples only in Chinese, and later prints Chinese-only user-facing messages as well. Because the skill does not provide an opt-in language choice or justify a region-specific restriction, it violates the language/locale policy criterion.
Natural-Language Policy Violations
Medium
- Confidence
- 95% confidence
- Finding
- The script prints self-test progress and usage/help text exclusively in Chinese, which imposes a specific language on users at runtime. Under the policy, this should not be forced unless the skill offers a language choice or clearly documents a justified locale limitation.
Ssd 3
Medium
- Confidence
- 79% confidence
- Finding
- This section instructs the agent to record user preferences, error history, and operational history into a persistent `learned_patterns.json` file and to automatically reuse those preferences later. Although framed as product learning and convenience, it is a plain-language directive to retain and reuse user-provided information, which creates a data-retention and potential leakage risk that depends on semantic intent rather than explicit exfiltration terms.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Content
# 1) 入链 log.emit("tool_call", "read /etc/hosts", "ok", "agent-7", "low", duration_ms=12) log.emit("tool_call", "write /tmp/x", "ok", "agent-7", "low", duration_ms=30) log.emit("tool_call", "delete /data", "error", "agent-7", "critical", duration_ms=5) log.emit("llm_call", "plan next", "ok", "planner", "low", duration_ms=420) assert len(log.events) == 4 print("[1] 入链 4 条事件 ✓")- Confidence
- 90% confidence
- Finding
- Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Content
# 2) 查询过滤 errs = log.query(status="error") assert len(errs) == 1 and errs[0]["action"] == "delete /data" print("[2] 查询 status=error -> 1 条 ✓") # 3) 错误率- Confidence
- 90% confidence
- Finding
- Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Static analysis
No suspicious patterns detected.