Security audit

memory-recall

Security checks for vulnerabilities and agentic risk

Overview

The skill's note search function is plausible, but it also includes a persistent cross-skill learning module that records usage, errors, notes, and preferences with weak scoping.

Install only if you are comfortable with a local script recursively reading note directories you specify and with an optional learner writing usage/preferences data to learned_patterns.json. Prefer using a narrow notes folder, avoid directories containing secrets, and do not use the learner unless you explicitly want persistent local learning state.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill instructs use of local scripts that read from user-specified directories and also references a learner system that records usage and preferences, implying both file read and file write behavior without an explicit permission declaration. In an agent setting, undeclared filesystem capabilities reduce transparency and can lead to over-broad access or unexpected persistence of user data.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The public description frames the skill as a note-retrieval tool, but the documented workflow also includes recording usage outcomes, persisting preferences, generating insights, and managing learning data for arbitrary skill directories. This mismatch is dangerous because users may authorize a benign-seeming search skill without realizing it performs additional collection and persistence, increasing privacy and integrity risk.

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: The module is explicitly designed as a generic cross-skill 'self-evolution' component for any WorkBuddy skill, which exceeds the declared purpose of this skill: local note/memory retrieval. That scope expansion is dangerous because it introduces persistent state collection and writeback behavior unrelated to retrieval, increasing the attack surface and enabling hidden data accumulation across uses.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code persistently stores operation history, error notes, recent actions, and user preferences to disk without any clear necessity for a note-retrieval assistant. In this context, notes, error messages, and preferences may contain sensitive personal information, so silent retention creates privacy and data-governance risk if other components or local users can read the file.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The resolver accepts either an arbitrary directory or a skill name under ~/.workbuddy/skills, allowing this module to operate on other skills' directories rather than being limited to this memory-recall skill's own data. In a skill meant to search a user's local notes, cross-skill filesystem targeting broadens access boundaries and could enable unintended reads/writes to unrelated skill state.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: Invocation phrases such as 'search my memory' or 'recall what we discussed before' are broad enough to overlap with ordinary conversation, making accidental invocation plausible. In this skill's context, accidental triggering can cause unintended local file searches across personal notes, exposing sensitive snippets or metadata when the user only meant conversational recall.

Static analysis

No suspicious patterns detected.