Security audit

meta-native-autonomous-discovery

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly harmful, but it asks the agent to persist user preferences and usage history and to modify its own instructions without clear consent or deletion controls.

Install only if you are comfortable with the skill keeping local cross-session memory about usage, errors, notes, and preferences, and with its instructions encouraging future behavior changes. Before using it, prefer an opt-in memory workflow, keep saved notes non-sensitive, and require a way to inspect and delete learned_patterns.json and approve any edits to SKILL.md.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill explicitly instructs use of a learner module that writes to persistent local files such as learned_patterns.json, yet no permissions or equivalent disclosure are declared. Undeclared file-write behavior weakens least-privilege expectations and can surprise operators by enabling silent persistence of usage history and preferences.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 78% confidence
Finding: The manifest presents the skill as an autonomous discovery/meta-reasoning capability, but the body expands into persistent learning, preference storage, reflection logging, and super-agent orchestration. This mismatch can mislead reviewers and users about the true operational scope, causing deployment into contexts that did not approve long-term data retention or broader autonomous behavior.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The documented behavior broadens from task-scoped autonomous discovery into generic cross-task learning and persistent user profiling, including storing preferences and historical usage. That scope expansion increases privacy and governance risk because data collected for one purpose may be reused for unrelated future tasks without clear necessity or consent.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill instructs persistent collection of user preferences and usage history into learned_patterns.json without clearly tying that collection to the stated autonomous discovery function. Unnecessary retention of behavioral and preference data creates avoidable privacy exposure and can leak sensitive patterns if the local file is accessed by other tools or users.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill encourages persistent storage of user preferences and usage-derived information but does not provide a clear privacy notice, consent flow, or retention policy. Collecting and reusing such data without transparent disclosure increases the risk of unauthorized profiling, data leakage, and noncompliant handling of personal information.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The example command stores '输出语言=中文' as a reusable preference for future interactions, which normalizes saving user preferences without explicit opt-in. While language preference is typically low sensitivity, silently persisting it still contributes to profiling and establishes a pattern for storing broader preferences without consent.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The skill directs storage of user preferences, error history, and usage insights in a local memory file for later reuse across sessions. Plain local retention of such data creates a straightforward leakage surface: other processes, users, backups, or logs may expose the file, revealing behavioral patterns and potentially sensitive operational context.

Static analysis

No suspicious patterns detected.