Security audit

meta-autonomous-researcher

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it asks for autonomous research, orchestration, and cross-session learning while only loosely documenting what it stores.

Review this carefully before installing. It appears to be a local self-learning research helper rather than malware, but you should assume it may keep task notes across sessions and avoid using it with sensitive research content unless you are comfortable with that local persistence.

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill appears to have file-write capability despite not declaring permissions, which breaks least-privilege expectations and prevents callers from making an informed trust decision. In this skill’s context, the claimed self-reflection/learner loop increases concern because hidden persistence can store data from tasks or conversations without explicit user awareness.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The documented purpose emphasizes research enhancement features, but the skill also performs persistent local storage of execution statistics and notes that is not transparently disclosed in the behavior description. This mismatch is dangerous because operators may run the skill assuming only reasoning/orchestration behavior, while it actually retains potentially sensitive task content or metadata across runs.

Static analysis

No suspicious patterns detected.