Security audit

cross-model-knowledge-extraction

Security checks for vulnerabilities and agentic risk

Overview

The skill’s extractor is local and understandable, but it adds persistent learning, user preference storage, and instructions to write experience back into the skill without enough scoping or consent.

Install only if you are comfortable with a local memory file that records usage history, errors, notes, and preferences. Treat any automatic or suggested edits to SKILL.md as requiring manual review, and avoid storing sensitive details in learner notes or preferences.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill exposes file read/write capabilities through documented scripts but does not declare those permissions in its manifest, which breaks least-privilege and prevents users or orchestration layers from understanding the actual trust boundary. Hidden or undeclared filesystem access is dangerous because it can be used to persist data, modify local state, or read sensitive files under the guise of a simple extractor.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose is a local signature extraction utility, but the documentation also defines a persistent learning subsystem that records usage history, failures, notes, and preferences to disk. This mismatch is dangerous because operators may authorize the skill expecting one-shot text processing while it actually accumulates behavioral data over time, increasing privacy, retention, and misuse risk.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The self-learning section introduces persistent storage of operational and user-derived data that is materially different from a 'zero-dependency signature extractor' as presented in the manifest. Even if local-only, this broadens the data surface and can surprise users, leading to unreviewed accumulation of potentially sensitive notes and failure details.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The documented collection of user preferences and failure history is not necessary for the narrow task of extracting capability signatures from SKILL.md text. This is risky because unrelated data collection expands the scope of information retained and may capture personal or operational details without a strong necessity basis.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The module persistently records operational history, error notes, and user preferences to disk for any supplied skill directory, even though the advertised skill purpose does not require telemetry. This creates unnecessary data retention and possible leakage of sensitive notes or behavior data, especially because notes/errors may contain user-provided content and are stored without minimization, consent, or access controls.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The section introduces automatic learning, persistence, and quality-improvement behavior that is outside the stated purpose of a capability-signature extraction skill. This kind of scope expansion is dangerous because it encourages collecting and retaining operational/user data and performing side effects not implied by the manifest, increasing privacy and integrity risk.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The instructions explicitly tell the system to write learned experience back into SKILL.md, which turns a read/extract skill into a repository-mutating one. Allowing the skill to modify its own instructions or repository files creates prompt/instruction drift, supply-chain integrity issues, and a path for persistent unintended behavior.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: Persisting user preferences, error patterns, and usage frequency is not justified by the extraction-only function described for this skill. Retaining such data creates unnecessary cross-session profiling and data minimization violations, especially when no consent, retention policy, or access controls are described.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill instructs storing preferences, error details, and usage history without any explicit privacy notice, consent flow, or retention policy. This is dangerous because free-form notes and error strings often contain sensitive user or environment information, and silent persistence increases the chance of accidental disclosure or policy violations.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The code writes user preferences, recent operations, error types, and notes to a persistent JSON file without any in-file privacy notice, sanitization, or safeguards. In practice, free-form notes and error context often contain sensitive operational details, so silent disk persistence can expose private information to other local users, backups, or later tooling.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill describes storing user preferences and usage/error history without disclosing persistence or privacy consequences. This is dangerous because operators or users may unknowingly cause sensitive behavioral data to be retained locally across sessions, where it could later be exposed, repurposed, or committed to source control.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Telling the agent to write learned experience into SKILL.md without warning about repository modification risks can lead to silent tampering of tracked files. This is dangerous because it can persist altered instructions, leak prior user-derived data into the repo, and confuse code review or downstream consumers of the skill.

Ssd 3

Medium

Confidence: 95% confidence
Finding: Persisting interaction details, repeated errors, capability history, and preferences in a local memory file creates a durable record that can leak sensitive operational context or personal data to later users, processes, or backups. In this skill's context, the risk is heightened because notes and error messages are free-form and may include secrets, filenames, or user-specific details unrelated to the extraction task.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The instructions direct persistent storage of preferences, usage counts, failures, and notes across sessions, creating a clear data retention and leakage risk in natural-language form. Because the stored content can include user-specific details and error notes, it may become a durable local memory store with unclear access control, retention, or sanitization.

Static analysis

No suspicious patterns detected.