Security audit

digital-template-factory

Security checks for vulnerabilities and agentic risk

Overview

The skill mainly makes digital templates, but it also records persistent local usage history, preferences, and error notes without clear consent or deletion controls.

Review before installing. The template-generation features are understandable, and I found no network exfiltration or destructive code, but the bundled learner keeps local memory about usage, errors, and preferences and can encourage later edits to the skill itself. Install only if you are comfortable with that persistent local profiling, or remove/disable the learner files and instructions first.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The skill is presented as a template-generation tool, but it also documents a persistent self-learning subsystem that records usage history, failures, errors, and user preferences. Hidden or under-disclosed stateful behavior expands the trust boundary and can collect data users did not expect to be stored, increasing privacy and misuse risk.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The documentation introduces a Bash/Python learning module unrelated to the core template-generation workflow, including commands that mutate local state. Unrelated execution instructions in a public skill increase attack surface and can normalize unnecessary code execution and persistence in contexts where users expect simple content generation.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The module is a generic cross-skill learning/telemetry component that can be invoked by any skill and persists usage data outside the narrow template-generation purpose declared in the manifest. That creates unnecessary data collection and capability creep, increasing privacy and supply-chain risk because unrelated skills may reuse it to accumulate operational history without user awareness.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The code persistently stores user preferences, recent operations, error notes, and capability history in learned_patterns.json without any access control, retention limit beyond recentOps truncation, or stated need tied to the skill’s advertised function. If notes or preference values contain sensitive user content, this creates a local privacy leak and durable profiling surface disproportionate to a template factory skill.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill states that it writes persistent user preferences and experience records, but does not clearly notify users in the normal skill description or request consent. Silent persistence of preference/history data can violate user expectations and lead to retention of sensitive workflow details or free-form notes containing personal information.

Ssd 3

Medium

Confidence: 92% confidence
Finding: Persistent storage of usage history, error notes, and user preferences creates a channel for unintended data leakage, especially when natural-language notes may include sensitive details copied from prompts or files. Because the memory is stored in a general JSON datastore, future runs or adjacent processes may surface prior user information outside its original context.

Static analysis

No suspicious patterns detected.