Security audit

data-privacy-guardian

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly a privacy and cybersecurity advisor, but it adds automatic cross-session learning that can store user preferences, notes, errors, and usage history without clear consent or deletion controls.

Review before installing. The core privacy advice content is not malicious, and I found no outbound data transfer, but the skill can keep local records about how you use it and any notes or preferences the agent records. Avoid sharing secrets or incident details unless the learner is disabled or updated to require opt-in, minimize stored fields, and provide inspect/delete controls.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill presents itself as a privacy and cybersecurity advisor, but it also includes a generic self-evolving learning system that records usage history, failures, and user preferences for arbitrary capabilities. That mismatch is dangerous because users seeking privacy guidance may disclose sensitive information without realizing the skill is designed to retain behavioral data beyond the stated purpose.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: Adding a self-evolving module that persists usage counts, errors, and preferences extends the skill beyond advisory behavior into cross-session profiling. In a privacy-focused skill, that creates heightened risk because the collected metadata can reveal habits, security posture, and potentially sensitive operational details.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The learner script stores user preferences and interaction history in a generic way not justified by the skill's privacy-guidance purpose. Because users may share details about passwords, incidents, devices, or fraud experiences, even metadata about those interactions can become sensitive and undermine the trust model of the skill.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The module is explicitly designed as a generic cross-skill learning component that records usage history, errors, preferences, and notes for arbitrary skills. In a privacy-focused skill, this creates unjustified persistence of behavioral and potentially personal data beyond the stated advisory purpose, increasing the chance of collecting sensitive information and conflicting with data-minimization expectations.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The code stores arbitrary preference values and free-form notes directly into learned_patterns.json, and those notes may include sensitive personal, account, device, or incident details. Because this skill is about privacy and security guidance, users are especially likely to provide confidential context, making uncontrolled local persistence a meaningful data-leak and over-collection risk.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill says it will automatically learn after each use and store user preferences and error history, but it does not provide a clear user-facing consent flow, retention policy, or data handling notice. In a privacy/security skill, silent persistence is especially dangerous because users are likely to share sensitive context while expecting confidentiality and minimization.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The documentation explicitly instructs the system to persist user preferences across sessions in a memory file. Cross-session storage in a privacy-oriented skill is risky because even preference keys and usage patterns can accumulate into a profile of the user's behavior, language, and potentially security needs.

Static analysis

No suspicious patterns detected.