Security audit

home-renovation-planner

Security checks for vulnerabilities and agentic risk

Overview

The renovation advice content is coherent, but the skill also adds a generic persistent learning system that records use, preferences, errors, and can alter skill behavior beyond the stated renovation purpose.

Review this skill before installing if you do not want a renovation assistant to keep local memory about your requests, preferences, failures, or notes. The renovation guidance itself appears ordinary, but the generic learner should be removed, made opt-in, or tightly scoped to non-sensitive renovation metadata with clear deletion controls.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill is presented as a home-renovation planner, but the documentation embeds a generic learning/persistence subsystem that can record usage, failures, preferences, and operate on arbitrary skill directories. This hidden secondary behavior expands the trust boundary and can enable unauthorized telemetry collection, cross-skill data handling, and unexpected file modification beyond the user's renovation-assistance expectations.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: Adding a general self-learning and persistence system inside a domain-specific renovation skill is dangerous because it introduces undocumented statefulness and file-writing behavior unrelated to the core function. That creates room for data accumulation, prompt/behavior drift, and covert expansion of capability without users realizing the skill is acting as a telemetry collector.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Persistent collection of user preferences, error history, and behavioral telemetry is not justified by the stated renovation-advice purpose, so users are likely not expecting this data retention. If abused or exposed, these records can reveal personal habits, project details, and interaction patterns, and can be repurposed across sessions or skills without meaningful user awareness.

Intent-Code Divergence

Low

Confidence: 88% confidence
Finding: The learner examples reference unrelated capabilities like resume optimization and price comparison, which strongly suggests the embedded subsystem is generic and reusable across arbitrary tasks rather than limited to renovation planning. This increases suspicion that the skill can be repurposed for broader data collection or behavior modification than advertised, even if the immediate impact is lower than direct code execution.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: This file implements a generic cross-skill learning and telemetry component rather than functionality specific to home renovation planning. In practice it enables broad persistence of usage data and preferences across skills, expanding data collection beyond the minimum needed for the stated purpose and creating an unnecessary surveillance and privacy risk surface.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The code persistently stores user preferences, error notes, capabilities used, and recent operation history in learned_patterns.json without any consent, retention limit beyond the last 20 ops for one field, or access control. Because a home renovation assistant may process sensitive household details, budgets, contractor issues, and personal preferences, this logging can expose private information if the local skill directory is accessed by other users, tools, or compromised processes.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The skill instructs persistent storage of user preferences and experience data in a natural-language JSON file, which raises leakage risk because sensitive details may be stored verbatim, inconsistently sanitized, and later surfaced or exfiltrated. Plain-language retention also increases the chance of collecting more data than necessary, including free-form notes and errors that may contain personal or confidential content.

Static analysis

No suspicious patterns detected.