Security audit

meta-interpretable-attribution

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a local attribution workflow with disclosed self-reflection logging, but users should be aware it can persist free-form notes locally.

Install only if you are comfortable with the skill keeping local usage/failure notes. Avoid putting secrets, private prompts, customer data, or sensitive filenames into learner notes, and consider deleting the generated learned_patterns.json file if you do not want history retained.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill text indicates persistent write-like behavior through 'self-reflection-loop', 'learner', and recording operational history, but no explicit permissions are declared. Undeclared file-write capability weakens sandboxing and informed consent, allowing the skill to modify local state or create persistence unexpectedly.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The skill is presented as an attribution/meta-reasoning capability, but it also describes persistent storage of reflections, learner updates, and cross-session evolution. This hidden statefulness can capture sensitive task data, create unintended retention, and alter future behavior in ways users do not expect from the declared purpose.

Context-Inappropriate Capability

Low

Confidence: 84% confidence
Finding: The code appends free-form notes and execution history to a persistent local file without any validation, minimization, or retention controls. In an agent setting, notes may accidentally contain prompts, task content, filenames, or other sensitive operational data, creating an unnecessary privacy and data-retention risk.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The function writes to disk automatically with no user-facing disclosure or opt-in. Even though the write is local and limited in scope, undisclosed persistence can violate user expectations and may leave behind operational traces or sensitive notes on shared systems.

Static analysis

No suspicious patterns detected.