Security audit

doc-reader

Security checks for vulnerabilities and agentic risk

Overview

The document reader itself is local and coherent, but the bundled generic learning script can persist free-form usage data across arbitrary skill directories without clear scoping or retention controls.

Install only if you are comfortable with a local document reader that also includes a generic learning log. Use doc_extract.py for local extraction, but avoid running learner.py with sensitive notes or document-derived details unless you accept that they may be saved in learned_patterns.json.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises file read/write capabilities through its documented scripts but does not declare corresponding permissions. In an agent ecosystem, undeclared filesystem access weakens reviewability and informed consent, and the write path is especially relevant because the skill also persists learned data to disk.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared purpose is local document extraction, but the skill also documents a persistent 'self-evolution' subsystem that records usage history, failures, preferences, and insights to learned_patterns.json. This is a meaningful behavior expansion because documents may contain sensitive business or personal data, and silent retention creates privacy, compliance, and data-minimization risks beyond what a user would reasonably expect from a reader tool.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The self-learning section explicitly instructs recording capabilities, failures, notes, and reflections and persisting them to learned_patterns.json. In the context of a document-reading skill, this creates an unexpected secondary data store that may capture sensitive operational details or user-derived information, increasing exposure if the host is shared or compromised.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: This file implements a generic cross-skill telemetry and self-learning mechanism, which is materially broader than the declared purpose of a local document-reading skill. That scope mismatch is dangerous because it creates hidden data collection and behavior-tracking capability that could be reused across unrelated skills without clear user expectation or consent.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The script persists preferences, notes, recent operations, and error history to disk for arbitrary usage, which can capture sensitive workflow details or user-provided content. In the context of a document-reading skill, storing such metadata is not clearly necessary and creates privacy and local data exposure risk, especially because notes may include document-derived or user-entered sensitive text.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The resolver accepts either an arbitrary directory path or a skill name under ~/.workbuddy/skills, allowing this script to read and write learning state for other skills. That cross-skill reach exceeds the stated document-reading purpose and weakens isolation boundaries, enabling unauthorized modification or inspection of other skills' local state if invoked with a different target.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The code writes user preferences and operation-related data to learned_patterns.json without any in-band warning, consent flow, or retention notice. Silent persistence is risky because users of a local document-processing skill may reasonably assume extracted content is handled transiently, while notes and preferences could contain sensitive personal or document-derived information.

Static analysis

No suspicious patterns detected.