Security audit

competitor-monitor

Security checks for vulnerabilities and agentic risk

Overview

The website monitoring functions fit the stated purpose, but the bundled generic learning script persistently stores arbitrary notes, errors, and preferences beyond that purpose.

Review this skill before installing. The crawler and snapshot scripts are ordinary for monitoring public pages, but only use the learner component if you are comfortable with it saving free-form operational notes and preferences locally in learned_patterns.json. Avoid recording secrets, internal URLs, customer data, or other sensitive details in learner notes or error messages.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill advertises and demonstrates network access and local state persistence (`--store`, `--out`) but declares no permissions or capability boundaries. Missing permission disclosure is dangerous because it hides the real trust surface from the operator, making unintended file writes or external requests more likely to be approved and executed without informed consent.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented purpose is competitor/site change monitoring, but the skill also includes a generic cross-skill learning subsystem that records arbitrary capability notes, failures, reflections, and persists them in `learned_patterns.json`. This broader behavior creates an unjustified data collection channel and expands the skill from a bounded monitor into a reusable telemetry/memory component, increasing the risk of storing sensitive operational or user-derived information beyond the stated purpose.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: A self-evolution subsystem that records cross-skill notes and failures is not necessary for page-diff monitoring and creates persistent memory that may accumulate sensitive internal workflow details. Because it is framed as generic learning rather than narrowly scoped monitoring state, it can silently broaden data retention and future behavior in ways the user did not request.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The file implements a generic cross-skill 'learning' component that persists usage history, errors, notes, and preferences, which exceeds the stated purpose of a competitor/site change monitoring skill. This creates an unnecessary telemetry and data-retention capability that can collect operational and potentially user-derived data across skills without clear scope limitation, increasing privacy and abuse risk.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The code persistently stores user preferences, capability usage, failures, error notes, and recent operations in learned_patterns.json, despite this functionality not being necessary for competitor monitoring. Notes and error fields are especially risky because they may capture sensitive user input, internal URLs, tokens, or operational context and retain them on disk without sanitization, retention limits beyond a small recentOps window, or access controls.

Static analysis

No suspicious patterns detected.