Security audit

ecosystem-auditor

Security checks for vulnerabilities and agentic risk

Overview

The main auditor is a coherent local skill-health scanner, but the package also includes an under-scoped learning module that can persist notes and preferences into arbitrary skill directories.

Install only if you are comfortable with a local auditor that can read your skill directories and ships a separate learning tool capable of writing persistent usage, error, note, and preference data into skill folders. Prefer running the main ecosystem_auditor.py audit path only, and avoid learner.py unless you explicitly want that local state written.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 74% confidence
Finding: The skill explicitly claims zero file side effects, yet the available analysis indicates file read and file write capabilities without any declared permissions. In a skill that scans arbitrary skill directories under ~/.workbuddy/skills, undeclared write capability weakens the trust boundary and could allow modification of the ecosystem being audited or persistence of state not disclosed to the user.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The declared purpose is a health audit, but the detected behavior includes persistent learning/logging, preference storage, usage-frequency collection, self-reflection, and initialization or writing of learning data files. This is dangerous because it materially exceeds user expectations for a scanner, enabling undisclosed data retention and filesystem changes in the scanned environment, which is especially sensitive for a meta-governance skill with broad visibility into the skill ecosystem.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The file implements a generic cross-skill learning and persistence module that collects usage history, error notes, and preferences for arbitrary skill directories, which is unrelated to the declared purpose of auditing the skill ecosystem and generating health reports. This scope mismatch is dangerous because it silently introduces telemetry-like state collection across skills, expanding the data footprint and enabling retention of potentially sensitive operational information without a clear need for the ecosystem-auditor skill.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: These functions load, modify, and write learned state for arbitrary skill directories selected by user input rather than performing audit/report generation. Because the path resolver accepts direct filesystem paths and writes learned_patterns.json into the target directory, the module can alter unrelated skills and persist cross-skill metadata, violating least surprise and creating an unauthorized write surface inside the skill ecosystem.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The module writes user preferences, operation notes, capabilities, and error details to disk in learned_patterns.json with no consent flow, retention policy, masking, or warning at the point of collection. Notes and preferences can easily contain sensitive information such as workflow details, secrets pasted by mistake, or identifying preferences, so persistent storage increases privacy and disclosure risk if the skill directory is shared, synced, or inspected by other tools.

Static analysis

No suspicious patterns detected.