Security audit

capability-decay-watchdog

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local watchdog for skill health data, with no evidence of hidden network access, automatic execution, or destructive behavior.

Install only if you want a local skill-health monitor that reads learned_patterns.json files under your skills directory. If you use learner.py, do not record secrets, credentials, private user data, or sensitive incident details in notes, errors, or preferences because they are saved in plaintext JSON.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 78% confidence
Finding: The skill advertises file read/write capabilities through its documented behavior and referenced script, but no explicit permissions are declared in the manifest. Undeclared filesystem access weakens reviewability and consent boundaries, making it easier for a skill to scan or modify other skills' data without operators clearly authorizing that scope.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The documented purpose is monitoring skill health, but the detected behavior extends into initializing learning files, recording operations and failures, tracking user preferences, and generating retrospective optimization insights. This expands the trust boundary from passive monitoring to telemetry collection and persistence, which can expose sensitive operational data and create unauthorized state changes across the skill ecosystem.

Context-Inappropriate Capability

Medium

Confidence: 80% confidence
Finding: The module stores arbitrary user preferences despite the stated purpose being decay monitoring, which expands collection beyond what is necessary. Unnecessary persistence of user-supplied preference data increases privacy risk, especially because values are accepted and written to disk without any minimization, consent, or schema restrictions.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The code accepts an arbitrary skill directory or skill name and then reads/writes learned_patterns.json there, allowing modification outside a narrow watchdog scope. In a multi-skill environment, this broad file-write capability can be abused to tamper with other skills' telemetry, poison learning state, or overwrite files in attacker-chosen directories if the caller can control the path.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: User preferences are persisted to disk without any disclosure, retention policy, or sensitivity controls. That creates a privacy and data-governance issue because users or operators may not realize arbitrary keys and values are being stored locally in plaintext for unspecified duration.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The module writes free-form notes and error details into recentOps and errorPatterns without any redaction or disclosure. Because notes and error fields may contain sensitive operational details, user data, or secrets copied from failures, plaintext persistence can leak information through local files, backups, or later tooling that consumes learned_patterns.json.

Static analysis

No suspicious patterns detected.