Security audit

emergent-collective-intelligence

Security checks for vulnerabilities and agentic risk

Overview

The skill’s main aggregation tool is ordinary local code, but it also adds a persistent learning system that stores preferences, errors, notes, and usage history beyond the core stated purpose.

Review this skill before installing if you do not want local cross-session memory. The aggregation code itself appears local and non-networked, but the learner can store workflow details, preferences, errors, and notes in the skill directory and may influence future use. Avoid recording sensitive notes or preferences unless you are comfortable with that local retention.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill documents file-writing behavior via `scripts/learner.py` and `learned_patterns.json` but does not declare permissions or clearly scope that persistence. Undeclared write capability is risky because a caller may invoke a skill believing it is stateless, while it actually stores data across runs and can modify files in the skill directory.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose is collective-intelligence aggregation, but the documentation adds a persistent learning/memory subsystem that records usage history, error data, and user preferences. That mismatch undermines informed consent and can lead to unexpected collection and retention of potentially sensitive operational metadata unrelated to the stated task.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill introduces persistent self-learning and memory behavior that is absent from the manifest's stated capability. Hidden statefulness is dangerous because users and orchestrators may treat the skill as a pure estimation tool, while it actually accumulates cross-run data that can influence future behavior and expose privacy or integrity risks.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Storing cross-run user preferences and operational history is not necessary for collective estimation and therefore expands data collection beyond the skill's stated need. This increases privacy risk and creates unnecessary long-lived state that could be reused, leaked, or manipulated without benefiting the core functionality.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The file’s documented purpose and implemented behavior are materially different from the skill manifest: instead of collective-intelligence orchestration, it provides a generic cross-skill telemetry and learning component. This kind of scope mismatch is dangerous because it can conceal broader data collection or reusable persistence capabilities that users and reviewers would not reasonably expect from the declared skill.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The module persistently stores user preferences, notes, errors, and operation history in learned_patterns.json without any minimization, retention control, or consent mechanism. Even if intended for quality improvement, this creates an unnecessary privacy and telemetry surface that could expose sensitive workflow details, user habits, or free-form notes if the local skill directory is accessed by other processes or users.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill describes automatic persistence of user preferences and usage history without a clear warning about retention, privacy consequences, or consent. Silent storage of cross-session data can expose sensitive behavioral information and violates reasonable expectations for a tool presented as an estimation/aggregation utility.

Ssd 3

Medium

Confidence: 95% confidence
Finding: Natural-language instructions to persist user preferences and usage history across sessions create durable state that may contain sensitive or identifying information. In this skill's context, such persistence is tangential to the core collective-intelligence function, making the retention harder to justify and more likely to surprise users or operators.

Static analysis

No suspicious patterns detected.