Security audit

human-in-loop-review

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate human-review purpose, but it adds broad self-learning persistence and the CLI does not actually preserve the review queue between runs.

Install only if you are comfortable treating this as a review-bucket skill that needs changes before production use. Remove or make the learning module opt-in, prohibit automatic SKILL.md modification, add explicit storage permissions and retention rules, and fix durable queue persistence before relying on it for approvals.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documents persistent writes to `learned_patterns.json` and audit/log state, but the manifest declares no permissions. This creates a capability transparency gap: operators and policy engines may assume the skill is non-writing when it actually stores data, which can bypass review expectations and increase risk of unauthorized persistence.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The advertised purpose is a human review gate, but the skill also includes a generic self-evolving learning subsystem that records usage, errors, and user preferences. This hidden expansion of scope is dangerous because users may invoke a safety control expecting only gating, while the skill silently performs retention and optimization behavior unrelated to the core approval workflow.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: A generic self-improving module embedded in a safety-control skill broadens behavior beyond human review into ongoing data collection and adaptation. In a security-sensitive control point, unrelated adaptive logic increases attack surface, makes behavior less predictable, and can weaken trust in the review mechanism over time.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The documentation says accumulated experience may be written back into `SKILL.md`, implying self-modification of the skill's own instructions. Self-rewriting security-adjacent logic is dangerous because it can alter future behavior without normal change control, audit review, or clear operator awareness, enabling configuration drift or prompt-level persistence.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The CLI documentation claims --add accepts structured JSON with fields like action and proposed_by, but the implementation passes the entire argument as a raw action string and ignores the documented metadata. In a security-control skill, this mismatch can cause callers to believe proposer identity and action structure are being audited when they are not, weakening approval integrity and enabling misleading or incomplete audit records.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The code comment states queue persistence is the caller's responsibility and _load_or_new always creates a fresh in-memory queue, but the skill description advertises built-in queueing and complete audit. For a human-review gate, loss of persistence means review records and pending approvals can disappear between invocations, allowing actions to evade expected oversight or making audit trails unreliable.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: Each CLI command initializes a new empty ReviewQueue, so add, pending, approve, reject, get, and summary do not operate on shared state across invocations. This breaks the advertised human-in-the-loop workflow entirely: a queued action cannot later be reviewed from the CLI, and operators may incorrectly assume dangerous actions are being held for approval when no durable queue exists.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: This file implements a generic self-learning and optimization subsystem inside a skill whose stated purpose is human review queueing and audit, which expands behavior beyond the declared trust boundary. In a human-in-the-loop security control, undeclared adaptive state and cross-run learning can silently influence future decisions, create hidden data retention, and undermine predictability and auditability.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code stores arbitrary preferences, notes, error patterns, and operational history to a persistent JSON file under attacker-controlled skill paths without enforcing schema minimization or sensitivity restrictions. In the context of a human-review skill, this can accumulate unnecessary behavioral telemetry or confidential notes across runs, increasing privacy exposure and creating a covert policy-influencing memory that is not clearly justified by the skill's stated function.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger list includes broad phrases such as '操作确认' and 'agent 审核', which are likely to appear in ordinary conversation. Overbroad invocation can unexpectedly activate the skill, causing unintended routing of actions, logging, or persistence in contexts where the user did not intend to use this control flow.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The skill persistently stores usage history, error details, and user preferences in natural language. Such retained data can easily contain sensitive operational context or personal information, creating confidentiality and secondary-use risks if the file is later exposed, reused by other skills, or incorporated into prompts.

Static analysis

No suspicious patterns detected.