Security audit

meta-agent-eval-harness

Security checks across malware telemetry and agentic risk

Overview

This skill is not clearly malicious, but it asks agents to persist user preferences and operational history and to modify the skill over time without clear consent, retention, or deletion controls.

Install only if you are comfortable with the skill keeping local cross-session memory about usage, errors, notes, and preferences, and potentially changing its own instructions over time. Before use, consider disabling or removing the learner step, reviewing learned_patterns.json regularly, and avoiding sensitive user content in recorded notes or preferences.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs use of a learner module that writes persistent state to local files, but the skill metadata declares no permissions or constraints around file writes. Undeclared write capability is dangerous because consumers and orchestrators cannot accurately assess or sandbox side effects, especially when the writes include cross-session memory and preference data.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 68% confidence
Finding: The description presents the skill as an evaluation/meta-orchestration harness, but the body also introduces persistent learning, preference storage, and self-modifying workflow expectations that are not clearly scoped in the declared purpose. This mismatch increases the risk of operators invoking the skill under false assumptions about its data handling and side effects.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The documented cross-session learning system goes beyond a normal agent evaluation harness by collecting usage patterns, error history, and user preferences into persistent memory. That expanded scope is risky because it broadens data collection and retention without a clear necessity tied to the harness's stated evaluation function.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill stores usage history and user preferences in a local memory file, but the description does not prominently warn users about this persistence. Hidden or under-disclosed retention is dangerous because users may provide data assuming a stateless evaluation tool, while the skill preserves it across sessions.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The script persistently records operational outcomes and arbitrary notes to a JSON file on disk without any notice, consent, retention control, or validation of the note content. In an agent setting, notes may include prompts, user-derived data, internal reasoning fragments, or other sensitive metadata, creating a privacy and data-governance risk if stored unexpectedly or later read by other components.

Ssd 3

Medium

Confidence: 92% confidence
Finding: The memory design explicitly persists operation counts, capability usage, error patterns, user preferences, and improvement suggestions across sessions without clear minimization boundaries. Persistent accumulation of broad interaction-derived data creates unnecessary privacy and data-governance risk, especially for a public skill that may be used in varied contexts.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The workflow directly instructs recording user preferences for future automatic reuse, which establishes cross-session profiling behavior. Without clear scope, consent, or controls, this can lead to silent persistence of personal or sensitive preference data and unexpected personalization.

Ssd 3

Medium

Confidence: 91% confidence
Finding: The iteration rules instruct writing important user preferences into persistent memory for future sessions, reinforcing long-term retention as a default behavior. In context, this is more dangerous because the skill is framed as a meta-evaluation harness rather than a personal assistant, so users may not expect ongoing profile storage.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.