meta-constitutional-self-alignment

• Outcome: Review
• Latest audit: Aug 14, 2026 · 1:49 AM UTC
• Version: 1.0.0

Overview

This skill is a local text-alignment tool with no network or credential behavior, but it also asks agents to keep persistent user/error notes and even suggests changing its own skill file despite claiming a read-only boundary.

Review before installing. Use the alignment checker only if you are comfortable with local scripts, and avoid running the learner on sensitive tasks unless you add controls for consent, redaction, deletion, and storage location. The artifact should be revised to remove unsupported super-agent claims, make persistence explicit, and stop suggesting automatic SKILL.md write-back.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documents file-writing behavior via `scripts/learner.py` and persistence to `learned_patterns.json`, but no declared permissions are present. Undeclared write capability is dangerous because operators may treat the skill as passive/read-only while it can actually persist state and potentially capture sensitive notes, preferences, or task history.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The skill markets itself as a broad self-verifying, self-reflective, super-agent meta-skill, but the documented behavior is mostly a deterministic text-rule workflow plus persistent logging. This mismatch can mislead users and orchestrators into granting trust, scope, or autonomy the implementation does not justify, while obscuring the real privacy and mutation behaviors that do exist.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The skill asserts a read-only safety boundary, yet later directs persistent writes to `learned_patterns.json` and even says experience may be written back into `SKILL.md`. Contradictory safety claims are dangerous because they defeat operator expectations and can enable unauthorized state changes, tampering, or silent retention of sensitive task data.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The manifest presents a constitutional alignment skill, but the body expands it into a broader self-evolving, cross-session memory system. This scope expansion matters because reviewers may approve the skill for narrow text-alignment use while it actually accumulates state and changes behavior over time.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Persistent user-preference storage and cross-session learning are not necessary for a constitutional text-alignment utility and introduce unnecessary data collection. Even local-only retention can expose sensitive user habits, free-form notes, or failure details to later users, processes, or backups.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill describes automatic learning and storage of user-related data without clearly warning that information persists across sessions. Silent persistence is dangerous because users may disclose sensitive operational details, preferences, or failures assuming the interaction is ephemeral.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The instructions explicitly encourage writing free-form error notes and user preferences to disk, which can easily capture secrets, personal data, proprietary content, or incident details. Free-text storage is especially risky because it is hard to sanitize consistently and often grows into an unreviewed sensitive-data sink.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: Persistent storage of preferences, operation counts, failures, and notes creates a durable data-retention surface that may later leak through local compromise, backups, logs, or unintended sharing. Because the content is natural language, it may contain more sensitive context than structured telemetry and is harder to audit or purge safely.

Static analysis

No suspicious patterns detected.