Security audit

cross-border-listing-optimizer

Security checks for vulnerabilities and agentic risk

Overview

The listing generator is mostly understandable, but it includes automatic persistent learning and self-modification instructions that users should review before installing.

Review this skill before installing if you do not want cross-session memory or self-changing skill instructions. The core listing features appear purpose-aligned, but users should disable or remove the learner workflow unless they explicitly want local history, preferences, and possible SKILL.md edits retained over time.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill is presented as an e-commerce listing generator, but it also embeds a generic learning subsystem that records usage, stores user preferences, and performs cross-session persistence unrelated to the core listing task. This hidden secondary behavior expands the trust boundary and can enable unauthorized retention of operational data or preferences without informed user consent.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The self-learning/persistence subsystem stores usage history, error data, and user preferences in a local memory file even though that behavior is not necessary for generating listings. Persistent storage of natural-language notes and preferences creates a data retention surface that may capture sensitive business context or user-specific information across sessions.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to 'write experience back into SKILL.md', meaning it can modify its own prompt/specification over time. Self-modifying instruction files are dangerous because untrusted runtime inputs or error notes can become persistent prompt content, enabling prompt injection persistence, policy drift, or future unsafe behavior.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The module is explicitly designed as a generic cross-skill telemetry and preference store for any WorkBuddy skill, which exceeds the stated purpose of a cross-border listing optimizer. That broad collection of operational history, errors, notes, and user preferences increases the risk of unnecessary data retention and cross-context privacy leakage, especially if notes or preferences contain sensitive business or user information.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The resolve_skill_dir logic accepts arbitrary directory paths or any skill name under ~/.workbuddy/skills, allowing this script to read and write learned_patterns.json for unrelated skills. In a multi-skill environment, that creates unauthorized cross-skill data access and tampering risk, enabling one skill component to inspect or overwrite another skill's telemetry and preferences.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The trigger phrases are broad enough that the skill could activate in loosely related conversations about cross-border e-commerce or listings. Overbroad activation increases the chance that the skill's writing and persistence behaviors run in contexts where the user did not intend to invoke them.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill documents file writing and persistent preference storage but does not clearly warn users at invocation time or obtain explicit consent. Silent persistence is risky because users may provide commercial data, preferences, or notes assuming they are ephemeral when the skill is designed to retain them.

Ssd 3

Medium

Confidence: 94% confidence
Finding: Persisting user preferences, usage history, errors, and notes across sessions in a natural-language file creates a leakage and retention risk. Such files often accumulate business-sensitive content, internal terminology, or user-specific details that can later be exposed to other runs, operators, or tools without the user's awareness.

Static analysis

No suspicious patterns detected.