Security audit

decision-review

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a local retrospective helper, but its persistent generic learning module can store sensitive notes and preferences across uses without tight scoping or retention controls.

Review this skill before installing if your retrospectives include sensitive personal, incident, customer, or business information. Use explicit output paths, avoid putting secrets or confidential details in learner notes or preferences, and periodically inspect or delete learned_patterns.json if you do not want cross-session retention.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill advertises and documents file-writing behavior via `scripts/retro.py --output retro.md` and persistent learning commands, but it declares no permissions. Hidden or undeclared write capability weakens user and platform trust boundaries because the skill can persist data to disk without an explicit manifest-level grant or user-visible expectation. In this context, the risk is amplified by the skill's handling of potentially sensitive personal or business retrospective content.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The manifest presents the skill as a simple retrospective assistant, but the documented behavior includes cross-session learning, capability/error tracking, preference persistence, and writing `learned_patterns.json` in the skill directory. That is a material expansion of scope beyond summarization: it creates behavioral telemetry and persistent state that users are not clearly told about in the primary description. Because the skill may process sensitive decision reviews, undisclosed retention and self-modifying optimization increase privacy, integrity, and surprise-execution risks.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: This file is explicitly designed as a generic cross-skill learning/telemetry component for '任意 WorkBuddy 技能', not a narrowly scoped decision-review helper. In the context of a retrospective assistant, persistent cross-skill logging and learning materially expands data collection and reuse beyond what users would reasonably expect, increasing privacy risk and the chance of unauthorized profiling across skills.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code persistently stores user preferences, capability usage, errors, and free-form notes in learned_patterns.json without any minimization, consent, expiry, or sensitivity filtering. For a decision retrospective assistant, those notes may contain sensitive business, personal, or incident details, so retaining them by default creates unnecessary exposure if the file is read by other components or a local attacker.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The manifest uses broad natural-language trigger phrases such as '帮我复盘', '这次决策怎么样', and '总结一下教训', which can match ordinary conversation and cause unintended invocation. Accidental activation matters more here because the skill can write files and persist learning state, so a casual utterance could lead to collection or storage of sensitive reflection data without the user deliberately selecting the skill.

Static analysis

No suspicious patterns detected.