Security audit

content-matrix-factory

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly a content-generation helper, but it adds persistent self-learning behavior and broad local write capability without clear opt-in, scoping, or deletion controls.

Review before installing. The content drafting and web research features are purpose-aligned, but the self-learning system should be treated as a local memory feature: it may retain preferences, operation history, and notes, and its helper can write learning files for other skill directories if invoked that way. Install only if you are comfortable managing or disabling that persistence and avoiding sensitive data in notes/preferences.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill is presented as a content-generation and distribution tool, but it also documents cross-session logging of operations, preferences, failures, and reflective optimization through a generic learner module. That hidden expansion of scope creates a data-governance and user-consent problem because users may disclose business plans, account strategies, or personal preferences without realizing they will be retained and mined for future behavior.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The documented learning system persists user data and states that experience may be written back into SKILL.md, effectively introducing self-modifying behavior into a content tool. Persistent memory plus skill-file rewriting can cause prompt drift, unauthorized behavior changes, and retention of sensitive operational data beyond the user's expectation.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The file explicitly implements a generic "self-evolving" learning module for arbitrary WorkBuddy skills rather than functionality scoped to the declared content-matrix skill. That broader capability expands the trust boundary and creates unnecessary access to usage history, preferences, and optimization data outside this skill’s stated purpose, increasing the risk of cross-skill data exposure or tampering.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: `resolve_skill_dir()` accepts an arbitrary directory path or a skill name under `~/.workbuddy/skills`, allowing the script to read and overwrite `learned_patterns.json` for other local skills. In the context of a content-generation skill, this is unrelated privilege expansion: it can inspect preferences and operational history of unrelated skills and modify their learning state without isolation controls.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill advertises automation and matrix operations without warning users that data may be written, retained, or used to personalize future behavior. This undermines informed consent and may expose sensitive commercial strategies, account plans, or user preferences to unnecessary storage.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The persistence and self-modification section explicitly instructs storing preferences and operation history and writing learned behavior back into the skill, but provides no warning, boundaries, or consent mechanism. In a public skill, that makes hidden retention and mutable behavior especially dangerous because ordinary users may trigger long-term state changes unintentionally.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The skill directs persistent storage of usage history, preferences, error notes, and reflective insights in a local JSON file, which can easily capture sensitive user-provided data in natural language. Because the notes and errors are free-form, operators may inadvertently store personal data, credentials, business secrets, or regulated information without safeguards.

Static analysis

No suspicious patterns detected.