Security audit

long-text-summarizer

Security checks for vulnerabilities and agentic risk

Overview

The summarizer itself is straightforward, but it also includes a persistent learning/logging component that is under-scoped for a document summarization skill.

Install only if you are comfortable with the skill creating a local learned_patterns.json usage profile. Avoid using the learner commands with confidential documents unless you first remove or disable note/preference persistence, or add explicit consent and deletion controls.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documentation instructs use of `scripts/learner.py record` to persist notes, errors, and usage history, which implies file-write behavior despite no declared permissions. Undeclared persistence is dangerous because it expands the trust boundary: operators may invoke a summarization skill without realizing it can create or modify local state and potentially retain sensitive document metadata or user notes.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill is presented as a long-text summarizer, but the documentation adds a generic self-evolution and usage-tracking subsystem that records failures, notes, and behavior over time. This mismatch is risky because users may provide sensitive source material for summarization without expecting retention, profiling, or cross-session analysis, leading to unintended collection and broader secondary use of data.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The documented self-evolution subsystem goes beyond summarization and introduces ongoing usage tracking and reflective analysis. Even without executable code shown here, embedding this behavior in the skill contract normalizes collection of operational history and can create a repository of sensitive document-derived metadata or analyst notes unrelated to the core task.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Recording usage history, failures, error types, and notes is not justified by the stated purpose of producing summaries, so it represents unnecessary data collection. Unnecessary telemetry increases privacy and data-handling risk, especially when the inputs may be long documents containing confidential business, legal, medical, or personal information.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The file describes and implements a generic self-learning/telemetry component that is unrelated to the stated purpose of a long-text summarization skill. Capability drift like this increases attack surface and can enable unadvertised collection of usage data or later reuse by other skills, which is risky even if no immediate exfiltration is present.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The code persistently records capabilities used, success/failure, error types, notes, and user preferences to disk in learned_patterns.json, creating a local profiling store not justified by the skill's advertised function. In a summarization context, notes and preferences may contain sensitive document-derived information, so this behavior can expose private data to other local users, later processes, or accidental inclusion in backups and logs.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: User preferences and operation notes are written to local disk without any user-facing notice, consent flow, or data handling explanation. Because notes are free-form, users or calling components may place sensitive content there, leading to silent retention of potentially confidential information.

Static analysis

No suspicious patterns detected.