Security audit

kb-sync

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly describes a knowledge-base sync helper, but it includes under-scoped cloud-sync claims and a persistent generic learning module that can write tracking data for arbitrary skill directories.

Review this before installing. Use it only with an explicit source directory and manifest path, run dry-run first, and do not let it upload notes or use external API tools until you have verified the destination, token handling, and secret filtering. Consider removing or disabling scripts/learner.py unless you specifically want persistent usage/preference tracking across skill directories.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill clearly instructs reading from a local source directory and writing a manifest file, yet it declares no permissions. Undeclared file read/write capability weakens security review and user consent because the agent may access or modify local data without explicit permission boundaries.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill description promises cloud sync, bidirectional diff, and conflict detection, but the documented implementation only performs local diffing against a manifest and references other tools for real sync. This mismatch is dangerous because users or orchestrators may trust the skill with sensitive knowledge-base operations it does not actually safeguard, leading to accidental data loss, incomplete syncs, or unsafe delegation to unspecified external components.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: This file implements a generic cross-skill learning/profiling subsystem rather than logic specific to knowledge-base synchronization. In the context of a kb-sync skill, collecting reusable usage history, preferences, errors, and optimization data expands the skill's data-handling scope beyond its declared purpose and creates unnecessary behavioral tracking that could be reused by unrelated skills.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The resolve_skill_dir function accepts an arbitrary directory or a skill name under ~/.workbuddy/skills, allowing this script to read and write learned_patterns.json for other skills. That breaks isolation between skills and enables unauthorized cross-skill profiling or tampering if this helper is invoked with another skill's path/name.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The invocation phrases are broad and do not define exclusion conditions, so the skill may trigger for vague requests about updating notes or comparing local and remote content. In a skill that reads local files and may later write manifests or invoke external sync tooling, over-broad activation increases the chance of unintended access, confusing execution, or accidental operations on the wrong dataset.

Static analysis

No suspicious patterns detected.