meta-calibrated-autonomy

• Outcome: Review
• Latest audit: Aug 14, 2026 · 1:49 AM UTC
• Version: 1.0.0

Overview

This skill is not clearly malicious, but it asks the agent to keep cross-session notes and potentially change its own instructions without enough user control.

Review this skill before installing if you do not want an agent to retain usage history or preferences across sessions. The main risk is local persistence and instruction self-modification, not network exfiltration: consider removing the SKILL.md writeback rule and requiring explicit opt-in plus deletion controls for learned_patterns.json.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documents file-writing behavior via `learned_patterns.json` and even suggests writing experience back into `SKILL.md`, yet no permissions are declared. Undeclared write capability weakens consent and review boundaries, making it easier for a seemingly advisory meta-skill to persist data or alter local files without explicit operator awareness.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The advertised purpose is autonomy calibration and self-verification, but the documented behavior also stores usage history, failures, notes, and preferences persistently. This mismatch is dangerous because users or reviewers may grant trust to a decision-support skill without realizing it performs cross-session data retention, increasing privacy and governance risk.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The learning subsystem stores broad user preferences and usage history that are not tightly scoped to autonomy gating decisions. Over-collection expands the amount of retained personal or contextual data and creates unnecessary surveillance/statefulness for a skill whose core function should be bounded decision routing.

Intent-Code Divergence

Medium

• Confidence: 82% confidence
• Finding: The skill promises a hard safety rule for critical-risk tasks, yet it also permits experience to be written back into `SKILL.md`, which could alter future decision policy. Allowing self-modification of the governing policy undermines assurance that the critical-risk block remains stable and can enable policy drift or tampering over time.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill states that user preferences and operational history are recorded, but it provides no meaningful privacy notice, consent mechanism, retention policy, or deletion path. Persistent collection without transparent disclosure can expose sensitive behavioral data across sessions and violate least-privilege expectations.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs persistent recording of usage history, failure notes, error details, and user preferences in a local JSON file. Such cross-session storage can retain sensitive user-provided content and operational metadata in plain form, increasing privacy exposure and creating a target for unintended reuse or disclosure.

Static analysis

No suspicious patterns detected.