Security audit

counterfactual-decision

Security checks for vulnerabilities and agentic risk

Overview

The skill’s calculator is local and straightforward, but it also adds persistent learning and self-modification instructions that are broader than the stated counterfactual-analysis purpose.

Install only if you are comfortable with the skill keeping local usage history and preferences in learned_patterns.json and with its instructions encouraging agents to update learned behavior over time. For sensitive decision inputs, use the counterfactual.py calculator directly and avoid running learner.py unless you intentionally want that local history.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises a simple local counterfactual calculator but also documents file-writing behavior via a learner subsystem without any declared permissions or clear consent model. Undeclared persistence increases the risk of silent local state changes, privacy leakage, and trust violations, especially when an agent may invoke the documented post-use commands automatically.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: There is a clear description-behavior mismatch: the stated purpose is bounded analytical computation, but the documentation adds a separate telemetry-like subsystem that records usage history, errors, and user preferences across sessions. This hidden expansion of scope is dangerous because users and orchestrators may grant trust appropriate for a stateless calculator while the skill actually performs persistent profiling and local data storage.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The documentation introduces a persistent learning subsystem despite claiming a zero-dependency, locally runnable computation tool. Even if local-only, retaining usage history and preferences changes the security and privacy model by creating durable state that can expose sensitive workflow details or influence future behavior unexpectedly.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Storing user preferences and usage/error history is not necessary for computing counterfactual scores and decisions, so it represents unjustified data collection relative to the declared function. Excess collection broadens privacy exposure and can accumulate sensitive behavioral metadata over time without a clear need-to-know basis.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The file implements a generic cross-skill telemetry and self-learning module that is not required for a counterfactual decision skill. This broadens the skill's capability beyond its declared purpose and creates an unnecessary data collection surface that could be reused across skills to accumulate operational history and user-related metadata.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The code persists preferences, notes, recent operations, error patterns, and timestamps to disk in learned_patterns.json without being necessary for the stated analytical task. This creates privacy and scope-creep risk because user behavior and free-form notes may contain sensitive information and remain stored locally beyond the immediate computation.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: A generic usage-learning and preference system is unjustified for a skill whose manifest describes deterministic counterfactual scoring and threshold evaluation. Unrelated adaptive behavior increases the chance of hidden state, unexpected outputs, and unauthorized profiling of user behavior across runs.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill describes automatic persistence of learned patterns and user preferences but does not provide a clear warning, consent flow, or privacy notice near the storage behavior. Silent storage is dangerous because users may input sensitive decision parameters assuming ephemeral processing, while the skill retains information for future sessions.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script writes user preference and operation data to disk with no warning, consent flow, or disclosure in the script behavior. Undisclosed persistence is dangerous because operators may assume the skill is a local analytical tool while it is actually retaining behavioral history and arbitrary note content.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The skill contains persistent instructions to store user preferences and usage history for future sessions, effectively directing long-term memory behavior without robust boundaries. In an agent setting, such instructions can normalize accumulation of cross-session data and increase the chance of privacy leakage, unintended profiling, or future prompt-context contamination.

Static analysis

No suspicious patterns detected.