Security audit

meta-academic-tutor

Security checks for vulnerabilities and agentic risk

Overview

The skill is an academic tutor, but it also directs persistent learning, preference tracking, and possible skill self-modification without clear user control or a consistent storage boundary.

Review this skill before installing if you do not want a tutor to keep cross-session academic profile data or write learned patterns into its installed files. Prefer installing only if you can confine its data directory, inspect or delete the saved profile and learned_patterns.json, and disable or supervise the self-evolution/write-back behavior.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documents file-writing behavior (`learner.py`, profile/session persistence, learned patterns) but declares no explicit permissions. This creates an authorization gap: a host or reviewer may treat the skill as lower-risk than it really is, while the skill still performs persistent writes. In a public skill that stores user-related data, hidden write capability increases the chance of unauthorized persistence or policy bypass.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The stated purpose frames the skill as an academic tutoring meta-skill, but the documented behavior includes persistent collection of usage statistics, notes, error patterns, and user preferences. That mismatch is dangerous because operators and users may not realize the skill is acting as a memory/telemetry system in addition to tutoring, which undermines informed consent and review. Hidden retention features in an educational context materially raise privacy and governance risk.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The file first promises that all local reads and writes are restricted to `<data_dir>`, but later says `learned_patterns.json` is stored in the skill directory. This inconsistent storage boundary is dangerous because it defeats the documented privacy model and can cause data to be written outside the expected sandbox or lifecycle-managed path. Such confusion often leads to accidental exposure, backup leakage, or improper access control.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The self-evolution section expands the skill from academic tutoring into general-purpose behavior tracking and adaptation, including recording capabilities, failure patterns, and user preferences over time. That scope creep is risky because it normalizes broad profiling not strictly necessary for the tutoring function, increasing the amount and sensitivity of stored data. A public-facing skill with vague self-improvement powers is more dangerous than a narrowly scoped educational assistant.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The skill explicitly mandates persistent retention of user profile data across sessions, including academic background and progress. In context, this creates a standing data collection and memory requirement for potentially sensitive educational profiling, and the skill is public and designed for repeated use. Without explicit consent, minimization, retention controls, and access boundaries, this persistence can expose private user information or be reused inappropriately.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The learner instructions direct recording of user preferences, interaction outcomes, and arbitrary notes for future reuse. This is dangerous because it extends beyond transient tutoring into durable behavioral memory, potentially capturing sensitive or unexpected personal data in free-form notes. Combined with the self-evolving framing, it encourages ongoing profiling without clear consent or strict schema controls.

Static analysis

No suspicious patterns detected.