Security audit

meta-metacognitive-monitoring

Security checks for vulnerabilities and agentic risk

Overview

The skill is not overtly malicious, but it asks the agent to persist learning data and rewrite its own instructions without clear user approval or limits.

Install only if you are comfortable with a skill keeping local behavioral notes and user preferences. Do not allow it to rewrite SKILL.md automatically; route any proposed threshold or instruction changes through explicit human review, and periodically inspect or delete learned_patterns.json if it may contain sensitive notes.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documents commands that write persistent data (`learned_patterns.json`) and even proposes updating `SKILL.md`, but it declares no permissions. That mismatch is dangerous because consumers and policy layers may assume the skill is read-only while it can alter local state and retain data across runs.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 84% confidence
Finding: The manifest presents the skill as a metacognitive monitoring and reliability layer, but the body describes persistence, preference storage, and self-evolution behaviors not clearly surfaced as operational capabilities. This can mislead operators about what the skill actually does, undermining informed consent and safe policy enforcement.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill explicitly states that accumulated signals should trigger writing changes back into `SKILL.md`, which is persistent self-modification of the skill specification. Self-modifying agent instructions are risky because they can bypass review, drift from approved behavior, and create an unbounded escalation path for future executions.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: A metacognitive monitoring skill does not need to rewrite its own manifest to perform monitoring, so this self-modification capability is unjustified and expands the attack surface. If abused, it could silently change future prompts, thresholds, or permissions in ways that persist beyond the current session.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill stores user preferences, activity counts, error notes, and reflective insights in a persistent JSON file without a clear up-front warning in the description. Persistent retention of behavioral and preference data can create privacy and profiling risks, especially if users are unaware that their interactions are being recorded across sessions.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The script writes invocation metadata and arbitrary notes to a persistent JSON file without any notice, consent, retention control, or validation. In this skill's context, the 'note' argument may contain user-derived or operationally sensitive text, so silent persistence can create an unintended privacy and data leakage risk even though the code is not overtly malicious.

Static analysis

No suspicious patterns detected.