Security audit

meta-value-alignment

Security checks for vulnerabilities and agentic risk

Overview

This alignment skill is not malicious, but it keeps cross-session notes and user preferences and suggests self-modifying behavior without clear user controls, so it belongs in Review.

Review before installing. Use it only in a workspace where local retained notes and preferences are acceptable, avoid recording secrets or personal data in learner notes, and clear learned_patterns.json between users or sensitive projects. There is no evidence of exfiltration or destructive behavior, but the persistence and self-modification guidance need stronger controls.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documents file-writing behavior via `scripts/learner.py` and `learned_patterns.json` but declares no corresponding permissions or user-visible boundary around persistence. This creates a capability transparency gap: operators may invoke the skill assuming it is stateless, while it can actually modify local files and retain execution artifacts across runs.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared purpose frames the skill as alignment/self-verification logic, but the content also instructs persistent storage of execution statistics, failures, notes, and preferences. That mismatch is security-relevant because users and orchestrators may not anticipate data retention, causing hidden collection of operational or user-derived data under the guise of a reasoning/meta-skill.

Context-Inappropriate Capability

Low

Confidence: 80% confidence
Finding: The code persists arbitrary caller-provided note content directly to disk without validation, minimization, or any sensitivity controls. In a skill context, those notes could contain prompts, secrets, personal data, or other sensitive operational context, creating unintended local data retention and possible downstream exposure to other components or users on the same system.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill states that `learned_patterns.json` stores user preferences, operation counts, boundary categories, and improvement suggestions, but it does not provide a clear privacy warning, retention policy, or consent flow. Persisting user-related preferences across sessions can expose sensitive behavior patterns or task history to later users, operators, or other components with filesystem access.

Missing User Warnings

Low

Confidence: 78% confidence
Finding: The file write silently stores telemetry and note content to disk with no user-facing warning or disclosure in the implementation. While not an exploit primitive by itself, this creates privacy and transparency risks because operators may not realize that invocation metadata and arbitrary notes are being retained locally.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The skill explicitly instructs persistent recording of user preferences and operational history across sessions, including failure notes and 'important user preferences.' In context, this is more dangerous because the skill is public and positioned as a reusable meta-skill, increasing the chance that multiple tasks or users will share the same retained state and that sensitive prompts or behavioral metadata will accumulate without isolation.

Static analysis

No suspicious patterns detected.