Security audit

meta-memory-cross-engine

Security checks for vulnerabilities and agentic risk

Overview

This skill is a memory/improvement helper, but it tells the agent to keep user preferences and edit its own instructions, so it needs review before installation.

Install only if you are comfortable with the agent keeping local history and preferences for future reuse. Before using it with private or sensitive work, add clear rules for opt-in storage, what may be saved, how to delete saved data, and prohibit automatic edits to SKILL.md unless reviewed by a human.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documents file-writing behavior and persistent state (`learned_patterns.json`) but declares no permissions or guardrails. Hidden or undeclared write capability is dangerous because it can modify local files and retain data without operator awareness, increasing the chance of unauthorized persistence or tampering.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The stated purpose is a memory-cross-engine meta-skill, but the behavior expands into persistent local storage of usage history, preferences, and learning artifacts. That mismatch is risky because reviewers and users may authorize the skill for one function while it quietly performs broader data collection and retention.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The skill instructs writing accumulated experience back into its own `SKILL.md`, creating a self-modifying prompt/instruction surface. Self-modification is dangerous because it can corrupt trusted instructions, introduce persistence of unsafe behavior, and make later audits unreliable or bypassed through accumulated prompt injection.

Description-Behavior Mismatch

Low

Confidence: 84% confidence
Finding: The skill's documented scope is memory-cross-engine enhancement, but it broadens into generic cross-task learning and persistent preference tracking. This scope creep is risky because it normalizes collection and reuse of user-derived data outside the narrowly expected purpose.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill says it automatically stores operation history, error patterns, and user preferences without warning users about retention or privacy consequences. Silent persistence of user-derived data creates privacy and compliance risk, especially across sessions where users may not expect long-term memory.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The instructions endorse writing learned data back into `SKILL.md` without warning that the skill file itself may be modified. Modifying operational instructions or packaged assets without explicit notice undermines trust and can persist unsafe changes across future runs.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The skill explicitly directs persistence of usage statistics, error patterns, and user preferences across sessions in a local file. Cross-session storage of behavioral and preference data can expose sensitive information, create unintended profiling, and expand the blast radius if the host is compromised.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The skill tells operators to record user preferences for automatic reuse in future interactions, which is persistent profiling behavior. Reusing stored preferences without clear consent can surprise users and may expose sensitive habits or attributes if the file is read by others.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The iteration rules mandate writing important user preferences into persistent storage for future automatic application. This entrenches long-term memory behavior without a consent or review checkpoint, increasing privacy risk and making accidental over-collection more likely over time.

Static analysis

No suspicious patterns detected.