Security audit

meta-academic-translation

Security checks for vulnerabilities and agentic risk

Overview

This translation skill is mostly transparent, but it asks for persistent learning and even self-modification of its own instructions without clear user consent or review controls.

Install only if you are comfortable with a translation skill keeping local learning state and potentially changing its own skill instructions. Prefer disabling or removing the learner behavior, forbidding writes to SKILL.md, and using an explicit opt-in data file with inspect and delete controls.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documents use of a learner module that writes persistent state (`learned_patterns.json`) and even suggests writing experience back into skill artifacts, but no permissions are declared to signal file-write behavior. Undeclared write capability is dangerous because it hides stateful side effects from reviewers and users, increasing the risk of unauthorized local persistence or later expansion into broader file modification.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The stated purpose is academic translation, but the actual documented behavior includes persistent local memory, usage/failure logging, preference storage, and behavior adaptation across sessions. This mismatch is dangerous because operators may authorize a translation skill while unknowingly deploying a profiling and persistence mechanism with broader privacy and integrity implications.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill includes a self-evolution system that records preferences and changes future behavior across sessions, which goes beyond a normal translation tool. Persistent adaptive behavior increases risk because it can silently accumulate sensitive patterns, create non-deterministic outputs, and make later actions depend on historical data the user did not expect to be retained.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The documented collection of user preferences, operation history, and error patterns is not clearly necessary for academic translation. Unjustified cross-session profiling is risky because it expands data collection beyond purpose limitation, potentially capturing sensitive workflow details and enabling tracking of users or tasks over time.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The skill explicitly says accumulated experience should be written back into `SKILL.md`, implying self-modification of its own specification. Self-modifying instructions are dangerous because they undermine reviewability and trust boundaries: the behavior reviewed today may differ tomorrow, and an attacker or faulty learner could gradually alter rules, expand scope, or embed unsafe logic.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill describes automatic persistence of user preferences and usage history, but does not present a clear runtime privacy notice, consent flow, or opt-in. This is dangerous because users may reveal document contents, preferences, and failure notes under the assumption of ephemeral processing, while the system silently retains them for future use.

Natural-Language Policy Violations

Low

Confidence: 86% confidence
Finding: The skill suggests storing an 'output language' preference and reusing it automatically in later sessions. While relatively low severity, this is still risky because silent preference reuse can cause unintended behavior, reveal cross-session tracking, and bypass explicit user confirmation for context-dependent translation choices.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The persistent learning module stores user preferences and usage history in plain language without clear minimization boundaries or sensitivity controls. This is dangerous because free-form notes and history can easily capture sensitive document details, personal data, or operational metadata, creating avoidable privacy and security exposure if accessed or reused improperly.

Static analysis

No suspicious patterns detected.