Security audit

exam-study-assistant

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly an exam study assistant, but it also adds automatic local memory and self-improvement behavior that stores user preferences and notes without clear consent or retention controls.

Install only if you are comfortable with the skill keeping a local plain-text memory of usage, errors, notes, and preferences inside the skill directory. Avoid entering sensitive personal details, schedules, weaknesses, account data, or confidential exam materials unless the persistence behavior is removed or made opt-in with deletion controls.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill declares broad write-capable tools and explicitly instructs persistence to a local JSON memory file, creating stateful behavior beyond a normal study assistant. Even if the write behavior is documented, undeclared or unjustified persistence increases the risk of silent data retention, integrity issues, and unintended cross-session profiling.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The published purpose is exam assistance, but the skill embeds a generic self-evolution and telemetry module that records usage, failures, preferences, and optimization insights for arbitrary capabilities. This mismatch is dangerous because it hides broader data collection and adaptive behavior from users and reviewers, undermining informed consent and making abuse or overscoped reuse easier.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The 'self-evolution' section describes persistent recording of usage analytics, error patterns, and user preferences across sessions, which is unnecessary for the core study-assistant function. This creates privacy and profiling risk because the skill can accumulate behavior history and preference data without clear minimization, consent, or lifecycle limits.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The documented Bash workflow introduces a code-execution-style operational path for recording and reflecting on usage, which is not justified by a study planning skill. This expands the attack surface by normalizing filesystem interactions and command invocation for a task that should primarily generate educational content.

Intent-Code Divergence

Low

Confidence: 85% confidence
Finding: Examples mentioning unrelated capabilities like résumé optimization and price comparison indicate that the learner module is generic and reusable across arbitrary tasks, not limited to exam assistance. That inconsistency is a red flag because it suggests hidden general-purpose telemetry or adaptation logic that exceeds the declared trust boundary.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: This code persistently stores user preferences, operational history, errors, and notes in learned_patterns.json without any minimization, sensitivity filtering, or access controls. In a study-assistant context, users may enter exam plans, personal weaknesses, schedules, or other sensitive notes, which can then accumulate across sessions and be exposed locally or through later outputs.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill describes automatic recording of user preferences and learning data to a local file without prominent user warning, explicit consent, or clear data handling boundaries. Hidden persistence is dangerous because users may disclose sensitive study history, weaknesses, schedules, or personal preferences without understanding they are being retained.

Ssd 3

Medium

Confidence: 95% confidence
Finding: Persisting user preferences and usage history in a local memory file creates data retention and leakage risk, especially when the stored content can include behavior summaries, errors, and notes. If the file is accessed by other components or retained indefinitely, it can expose sensitive patterns about the user across sessions.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The promise to become 'more tailored to you' by remembering prior interactions encourages cross-session retention and profiling, which expands data collection beyond the immediate task. In the context of a study assistant, that is unnecessary and risky because it can silently accumulate personal learning habits, weaknesses, and preferences over time.

Ssd 3

Medium

Confidence: 88% confidence
Finding: The documented design explicitly includes recording user preferences and free-form notes for later accumulation and reflection, which encourages retention of potentially sensitive user data in plain form. In an education assistant, such notes can easily include personal study habits, schedules, weaknesses, or confidential exam-prep details, making accidental disclosure more likely.

Ssd 3

Medium

Confidence: 96% confidence
Finding: recentOps stores arbitrary note content and error metadata directly, preserving user-supplied text for later retrieval. This creates a clear data exposure risk because any sensitive text entered during use can be written to disk and later surfaced through debugging, summaries, or local file access.

Ssd 3

Medium

Confidence: 95% confidence
Finding: get_insights returns all stored preferences verbatim, which can directly disclose accumulated private user data to anyone invoking the insight command or reading its output. Because preference values are unrestricted strings, sensitive information may be echoed back without filtering or masking.

Ssd 3

Medium

Confidence: 96% confidence
Finding: self_reflect interpolates the last recorded note directly into generated guidance, which can re-expose sensitive text that was previously stored. This increases disclosure risk because users or operators may not expect old free-form content to appear in later reports or console output.

Static analysis

No suspicious patterns detected.