Security audit

complaint-letter-pro

Security checks for vulnerabilities and agentic risk

Overview

The skill mainly generates complaint letters, but it also tells the agent to automatically persist usage history, preferences, notes, and even improvement feedback for a sensitive dispute workflow without clear user consent or retention limits.

Review before installing. The letter-generation behavior is useful and not inherently unsafe, but this skill should ideally remove or disable the learner module by default, narrow triggers, and require clear consent before saving any complaint facts, user preferences, notes, or dispute history.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill is presented as a complaint-letter generator, but it also contains a generic cross-session learning and persistence subsystem that records usage, failures, notes, and user preferences. That hidden extra behavior expands the trust boundary and can collect or retain potentially sensitive dispute, labor, or consumer-complaint data without being part of the stated user-facing purpose.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Embedding Bash/Python script invocation and a reusable self-improvement module inside a document-generation skill introduces unnecessary execution-adjacent instructions unrelated to the declared task. In context, this increases attack surface and encourages persistent state mutation in a skill that may handle sensitive personal complaints, employment disputes, and evidence summaries.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The module stores user preferences and operation history for a complaint-letter skill, which exceeds the narrowly declared purpose of generating complaint documents. Persisting behavioral history and preferences creates unnecessary data retention risk, especially because notes may contain sensitive dispute details, personal data, or employment/consumer complaint facts.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The resolver accepts arbitrary directory paths or skill names under ~/.workbuddy/skills, allowing this script to read and write learning data for any specified skill rather than being scoped to the current one. This weakens isolation between skills and can let one skill tamper with or inspect another skill’s usage data if invoked with attacker-chosen paths.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: Broad triggers such as '投诉', '退款', or '纠纷' can cause the skill to activate in ordinary conversations where the user did not intend to invoke a rights-letter workflow. Unintended activation becomes more risky here because the skill also includes persistence behavior, potentially causing irrelevant or sensitive user context to be processed or stored.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill instructs the system to persist user preferences, usage history, failures, and notes to a local memory file without clear notice, consent, retention limits, or data minimization. Because this skill is used for disputes, labor issues, and complaints, the stored notes may contain sensitive personal, financial, or employer/merchant conflict information that could later be exposed or misused.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script writes user preferences and free-form notes to disk without any explicit notice, consent flow, or data handling controls. In this skill context, notes may include complaint evidence, addresses, employer details, order information, or other sensitive personal data, making silent persistence a privacy and data exposure risk.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The persistent learning instructions explicitly direct the skill to store cross-session data in learned_patterns.json, including user preferences and usage-derived details. In this skill context, that is especially sensitive because complaint and rights-protection workflows often involve names, order details, employment issues, evidence summaries, and dispute histories that should not be silently retained.

Static analysis

No suspicious patterns detected.