Security audit

meta-reflection-replanner

Security checks for vulnerabilities and agentic risk

Overview

This skill is not overtly malicious, but it asks agents to keep cross-session memory and modify its own skill instructions without clear consent or containment.

Install only if you want a stateful replanning skill that can remember usage history and preferences across sessions. Review or disable the learner workflow in sensitive environments, avoid recording secrets or private task details in notes, and do not allow automatic edits to SKILL.md unless you have a separate review process for changed skill instructions.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill instructs the user/agent to invoke `python scripts/learner.py` commands that record data and update persistent files, which implies file-write capability despite no declared permissions. Undeclared write behavior weakens auditability and informed consent, and can lead to unexpected modification of local files or state across sessions.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 75% confidence
Finding: The description presents the skill as a reflection/replanning meta-skill, but the body also includes persistent learning, preference storage, and self-modification behaviors that materially change its risk profile. This mismatch can mislead operators into invoking a skill with broader stateful behavior than they intended.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The documented behavior goes beyond reflection/replanning into persistent cross-session learning and instructions to write changes back into local artifacts. A skill that accumulates history and evolves itself can create covert state, propagate mistakes, and make future behavior less predictable and harder to review.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The skill stores user preferences, error history, and usage statistics in `learned_patterns.json` without clearly tying that retention to the narrow purpose of reflection/replanning. Unnecessary retention increases privacy risk and can expose sensitive task history or user-specific preferences across sessions.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The skill claims it only revises step lists, yet later iteration rules direct writing learned experience back into `SKILL.md`, which implies broader self-modification than disclosed. This contradiction is dangerous because operators may assume the skill is non-self-modifying when it can alter its own instructions over time.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The stated limitation that the skill only revises step lists conflicts with later guidance to persist experience back into `SKILL.md`, creating an internal inconsistency about the true scope of change. Such contradictions undermine safe deployment controls because reviewers cannot reliably infer what the skill may modify.

Vague Triggers

Medium

Confidence: 73% confidence
Finding: The invocation guidance says to directly use the skill for the entire reflection-replanner domain, without narrow trigger conditions or boundaries. Overly broad activation criteria can cause the skill to be used in inappropriate contexts, increasing the chance that its persistence and self-evolution features run when not needed.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill describes automatic persistence of user preferences and long-term usage history, but does not provide a clear warning or consent mechanism for data retention. Silent retention can violate user expectations and organizational policy, especially when task history may contain sensitive information.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill instructs writing preferences and learning data into persistent local files, but does not warn that local skill artifacts may be modified or that this can affect future runs. Unannounced local modifications can surprise operators, complicate forensic review, and create unintended stateful behavior.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The script persists invocation notes and operation outcomes to a local JSON file without any notice, consent, minimization, or sensitivity checks. If notes contain prompts, secrets, or user-derived content, this creates a quiet retention channel that can leak sensitive information to later readers or other components on the same host.

Ssd 3

Medium

Confidence: 92% confidence
Finding: The natural-language instructions explicitly direct persistence of user preferences and usage history across sessions, creating durable state that may contain sensitive operational context. Cross-session memory without strong minimization, consent, and deletion controls is a meaningful privacy and security risk.

Static analysis

No suspicious patterns detected.