Security audit

meta-agent-society-protocol

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it asks agents to persist user preferences and modify the skill's own instructions without enough scope, consent, or deletion guidance.

Review this before installing if you do not want a skill to keep local memory about usage, errors, or preferences. It should be treated as Review because it can persist notes and direct future behavior changes, including edits to its own SKILL.md, without clear opt-in, retention, or deletion instructions.

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill describes writing persistent data to a local JSON file and updating the skill content over time, but declares no permissions or safety boundaries for file-write behavior. Undeclared write capability increases the risk of unexpected state changes, data retention, and abuse by downstream agents or users who are not informed that the skill can persist or modify local artifacts.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The skill is presented primarily as an orchestration and reasoning meta-skill, but it also performs persistent logging of usage outcomes and preferences. This mismatch is dangerous because operators may invoke it expecting transient reasoning behavior while it silently accumulates local state, which affects privacy, auditability, and trust assumptions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly stores operation counts, error patterns, user preferences, and improvement notes in a persistent file, but provides no privacy notice, retention policy, or guidance on sensitive data handling. This can lead to inadvertent collection of personal or confidential information that remains on disk across runs and may later be exposed or reused improperly.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The script persistently writes operational metadata and arbitrary notes to a local JSON file without any disclosure, consent, retention control, or sanitization. In an agent skill context, this can create an unintended data collection channel where prompts, task details, or sensitive notes are stored on disk and later exposed to other components or users.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The skill instructs persistent collection and reuse of user preferences and usage history across future runs, creating a durable memory layer without clear limits on scope, retention, or sensitivity. This is dangerous because natural-language notes and preferences often contain personal, proprietary, or context-specific data that can be leaked, replayed inappropriately, or accessed by unrelated future tasks.

Static analysis

No suspicious patterns detected.