meta-super-agent-bootstrap

• Outcome: Review
• Latest audit: Aug 14, 2026 · 1:47 AM UTC
• Version: 1.0.0

Overview

The skill is not malicious, but it asks agents to persist usage history, errors, preferences, and even evolve the skill without clear privacy limits or user control.

Install only if you are comfortable with a skill that keeps local cross-session memory. Do not let it store secrets, personal data, customer data, credentials, financial or health details, or confidential business context; review and delete its learned_patterns.json data as needed, and require human review before any change is written back into SKILL.md.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs use of persistent write operations via `scripts/learner.py` and explicitly says it writes logs, insights, and preferences into `learned_patterns.json`, yet no permissions are declared. Undeclared file-write capability is dangerous because it bypasses least-privilege review and can lead to silent persistence of data, configuration drift, or unauthorized modification of skill artifacts.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The documentation directs persistent collection of usage history, error patterns, and user preferences across sessions, which exceeds what is necessary for a bootstrap/orchestration helper unless tightly justified and consented. This creates privacy and data-minimization risks because accumulated natural-language memory can contain sensitive operational details or personal preferences unrelated to the immediate task.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill says it automatically records and reuses user preferences without disclosing privacy, retention, or sensitivity boundaries. Silent preference persistence is dangerous because users may not realize personal data, workflow habits, or sensitive contextual choices are being stored for future runs.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The instructions explicitly tell operators to write preferences into persistent storage but omit safeguards against storing sensitive or identifying data. Without warnings and validation, operators may persist confidential user information in a plaintext or weakly protected memory file, increasing leakage risk across sessions.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The example preference command sets output language to Chinese as a persisted default without framing it as an opt-in example. While not severe by itself, forcing or normalizing a persistent preference without user choice undermines consent and illustrates the broader unsafe pattern of storing user preferences by default.

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: The script persistently writes operational metadata and free-form notes to a local JSON file without any consent, notice, retention control, or validation. While this is not an exploit by itself, it creates a privacy and integrity risk because user- or task-derived content may be stored unexpectedly and could later expose sensitive information or be abused for prompt/history poisoning within the skill's self-evolution loop.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill promotes persistent cross-session memory of preferences, errors, and usage patterns, creating a natural-language data retention surface that can leak sensitive context or enable unintended profiling. Because the memory file is meant to accumulate over time and be reused automatically, any accidental secrets or personal details stored once may influence future tasks or be exposed later.

Static analysis

No suspicious patterns detected.