Security audit

formal-capability-contract

Security checks for vulnerabilities and agentic risk

Overview

The contract verifier works as described, but it also includes a persistent self-learning system that records usage, errors, notes, and preferences beyond the core verification purpose.

Review before installing. The verifier script itself is local and appears non-destructive, but the skill asks the agent to keep a persistent local memory of usage, failures, notes, and preferences. Install only if you are comfortable with that local history being created, and avoid recording sensitive document contents, identifiers, secrets, or private user details in learner notes or preferences.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises executable commands that write persistent state (`learned_patterns.json`) but declares no corresponding permission boundary. This creates hidden write capability, making it easier for the skill to modify local state without clear authorization or review, and it compounds the privacy risk because the writes are specifically used to retain usage history and preferences.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose is formal contract verification, but the documentation adds a separate telemetry/learning subsystem that stores capability usage, errors, and user preferences. This mismatch is dangerous because users and reviewers may grant trust appropriate for a verifier while unknowingly enabling cross-session data collection and behavior shaping unrelated to the stated function.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill is framed as a formal verifier, yet a persistent self-evolution subsystem is embedded in the documentation to record errors, preferences, and usage over time. That broadens the trust boundary from deterministic verification into behavioral data retention, increasing privacy and governance risk without being essential to the core verification task.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Persisting user preferences and usage history is not justified by the stated need to verify capability contracts for a single execution trace. Collecting extra state creates unnecessary retention of potentially sensitive operational details, which can later be exposed, misused, or relied upon outside user expectations.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The module explicitly advertises and implements cross-skill telemetry, error tracking, and preference persistence for arbitrary skills, which exceeds the declared purpose of a formal capability-contract verifier. In a security-sensitive verification skill, collecting unrelated operational history creates unnecessary data retention and broadens the trust boundary, enabling surveillance of agent usage patterns and persistence of user data without clear justification.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The data model stores arbitrary preferences, notes, recent operations, and error history for any skill with no schema restrictions or purpose limitation tied to formal verification. This creates a privacy and data-governance risk because sensitive user or workflow information can be silently accumulated in a local file and later consumed by other components.

Intent-Code Divergence

High

Confidence: 90% confidence
Finding: The file presents itself as a universal self-evolving learning subsystem rather than a formal verification helper, signaling capability drift from the advertised skill. In the context of a formal-contract skill, this mismatch is dangerous because users and integrators may grant trust based on verification semantics while the code performs broader stateful tracking unrelated to that purpose.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The documented behavior adds a self-evolving learning and persistence subsystem that is materially outside the declared purpose of formal capability contracts and correctness verification. This scope mismatch is dangerous because it can smuggle in undeclared data collection and behavior-changing side effects under the cover of a verification skill, reducing transparency and trust boundaries for users and reviewers.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Persistent storage of usage history, errors, and user preferences is not justified by the stated formal-verification function and creates hidden collection of cross-session behavioral data. In this context, the mismatch makes the feature more dangerous because users invoking a proof/correctness tool would not reasonably expect profiling or preference retention.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The workflow instructs the system to modify skill documentation based on accumulated runtime experience, which introduces a self-modifying capability outside the declared scope of formal verification. Self-editing documentation can be abused to drift behavior, hide failures, or embed unreviewed instructions over time without proper change control.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The markdown describes automatic local storage of usage outcomes and preferences but gives no explicit warning that data will be persisted. Silent persistence is risky because users may provide sensitive error notes or preference information believing the interaction is ephemeral, while the skill retains it across sessions.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill describes storing preferences, error patterns, and usage statistics in a local memory file without any privacy notice, consent flow, or retention policy. That omission creates a meaningful privacy risk because even local files can expose sensitive user behavior and may later be reused or exfiltrated unintentionally.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Automatic post-use logging and preference capture without warning users creates undisclosed activity tracking. In a formal-verification skill, this is especially problematic because the context suggests deterministic checking, not behavioral telemetry, so the hidden logging violates user expectations and informed consent.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The instructions explicitly direct the skill to retain user preferences, failure notes, and usage details in a local memory file across sessions. Natural-language records often contain sensitive context, and retaining them increases the risk of later disclosure, prompt leakage, or unintended reuse in unrelated tasks.

Ssd 3

Medium

Confidence: 96% confidence
Finding: Persisting user preferences and usage details in a natural-language local file creates a straightforward data retention and leakage risk, especially if the file is readable by other tools, users, or later prompts. Natural-language memory stores are hard to sanitize and can accumulate identifying or sensitive context over time.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The failure logging example explicitly encourages free-form notes about user-provided content, which can easily capture sensitive documents, identifiers, or confidential context and then retain them across sessions. Because the note field is unconstrained, it substantially increases the chance of accidental sensitive-data collection.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The rule to save important user preferences for automatic future reuse implies cross-session profiling and persistence of user-specific data. In the context of a formal capability verification skill, that persistent personalization is unrelated to core function and increases the risk of privacy violations or unintended disclosure.

Static analysis

No suspicious patterns detected.