cost-budget-control

• Outcome: Review
• Latest audit: Aug 14, 2026 · 1:46 AM UTC
• Version: 1.0.0

Overview

The skill provides a normal cost-budget script, but it also asks the agent to persist usage history and user preferences in ways that are broader than cost control.

Review this skill before installing if you do not want a skill to keep local history or preferences. The budget-control script appears local and straightforward, but the bundled learner stores durable usage data and is broader than the advertised budget-enforcement function.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no permissions, yet the documentation explicitly instructs use of a learner subsystem that writes persistent data such as learned_patterns.json. This creates an undeclared file-write capability, which undermines transparency, consent, and policy enforcement around what the skill is allowed to store locally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The stated purpose is budget estimation and enforcement, but the skill also includes persistent learning, preference tracking, error logging, and reflection behavior unrelated to core cost control. This mismatch is dangerous because operators may approve or invoke the skill expecting narrow functionality while it silently accumulates user data and behavioral history.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The documentation adds a persistent self-learning and preference-tracking subsystem that is not represented in the manifest’s declared scope. Hidden or weakly disclosed stateful behavior increases the risk of unauthorized retention of user data and makes downstream security review and sandboxing less reliable.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Persistent collection of user preferences, failures, and usage history is not necessary to perform token/cost estimation or hard budget enforcement. Collecting extra state broadens the privacy and security attack surface, especially if logs include sensitive workflow details or user-specific preferences over time.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The file advertises a generic cross-skill 'self-evolution' learner that records usage history, errors, notes, and user preferences, which is outside the stated purpose of a cost/budget-control skill. This creates unnecessary data collection and persistence that can leak behavioral history or preferences across skills, expanding the privacy and trust boundary without clear user consent or need.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The implemented behavior is not budget enforcement but a general-purpose learning subsystem that reads and writes learned state files, tracks activity, and accumulates preferences. In a skill advertised as hard cost-control, this functionality mismatch is dangerous because operators may trust the skill for budget enforcement while it silently performs unrelated persistent tracking, increasing attack surface and enabling covert stateful behavior.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill claims post-use automatic learning and preference accumulation but does not clearly warn users that local persistent storage will occur. Lack of explicit disclosure prevents informed consent and may lead to silent retention of sensitive operational or preference data on disk.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly instructs the agent to persist user preferences and usage history for future interactions, creating durable state across sessions. Cross-session memory can expose sensitive user patterns, create profiling risk, and cause later behavior to be influenced by stale or unauthorized data.

Static analysis

No suspicious patterns detected.