Security audit

meta-adversarial-robustness

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it asks the agent to keep cross-session memory and modify the skill itself without clear user controls.

Review this skill before installing if you do not want skills to retain cross-session notes or change their own instructions. If installed, keep notes non-sensitive, periodically inspect or delete learned_patterns.json, and do not allow automatic SKILL.md rewrites without human review.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill documentation instructs use of a learner component that records data and writes memory files, but the skill declares no permissions. This creates a transparency and governance gap: operators may execute a skill believing it is non-persistent when it actually performs file writes, which can lead to unauthorized local state changes and hidden retention of operational data.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill states that it automatically records evaluation history, user preferences, and other learned patterns across runs, but it does not present a user-facing warning, consent flow, retention policy, or scoping rules. Silent persistence of user-related activity data can violate privacy expectations and leak sensitive workflow details if the memory file is later accessed or reused.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: The script persistently records operation outcomes and arbitrary notes to a local JSON file without any notice, consent mechanism, retention limit, or sanitization. While not directly exploitable as code execution, this can create a privacy and data-handling issue if notes contain user inputs, secrets, prompts, or other sensitive operational metadata, especially in an agent skill that logs its own behavior for ongoing evolution.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The skill explicitly instructs persistent recording of user preferences, operation counts, failure records, and notes in a cross-session memory file. In context, this is more dangerous because the retained notes may contain sensitive prompts, decision failures, or user-specific operational patterns, creating a durable local data trail that can be exfiltrated or misused later.

Static analysis

No suspicious patterns detected.