Security audit

metacognitive-monitoring

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a local metacognitive monitoring tool, but it also keeps persistent user/usage data and tells agents to rewrite the skill over time without a clear consent or review boundary.

Review this before installing if you do not want a skill to keep local history about decisions, errors, notes, or preferences. The core monitor is local and low-risk, but the learning feature should be treated as stateful: inspect learned_patterns.json, avoid storing sensitive notes or preferences, and do not allow automatic SKILL.md rewrites without manual review.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documents file-writing behavior via the learner subsystem but declares itself as a pure local monitoring layer without corresponding permission disclosure. Undeclared write capability is dangerous because it expands trust assumptions: operators may invoke the skill expecting read/compute-only behavior while it persists data or modifies local files.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose is a metacognitive decision gate, but the documentation adds broader stateful behaviors including persistent logging of actions, storing user preferences, generating insights, and reading/writing learned state files. This mismatch is dangerous because users and orchestrators may authorize the skill for low-risk monitoring while it silently accumulates behavioral data and alters local state beyond that role.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The self-improvement section expands a monitoring skill into a persistent profiling subsystem that records decisions, failures, preferences, and learned patterns, and even suggests modifying skill artifacts over time. That broadening increases attack surface and privacy risk because a supposedly simple guardrail component becomes stateful and self-modifying in practice.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The documentation explicitly proposes rewriting SKILL.md based on accumulated events, introducing self-modification of the skill definition. Self-modifying behavior is dangerous because it can change future execution semantics, permissions expectations, and operator trust boundaries without review, making abuse or accidental drift much harder to detect.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Persistent storage of user preferences exceeds the narrowly described monitoring role and creates a durable user-profile surface. Even if intended for convenience, retaining preferences without strong scoping or consent can leak sensitive workflow information and creates hidden state that affects later runs.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The file implements a generic cross-skill learning and persistence component that is materially different from the declared metacognitive monitoring guard-layer. This kind of scope mismatch is dangerous because it introduces undeclared stateful behavior, preference tracking, and cross-skill utility functionality that users and reviewers would not expect from a confidence-monitoring skill, weakening trust boundaries and enabling stealthier expansion of capability.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The code records preferences, usage history, and optimization insights unrelated to the stated local metacognitive monitoring purpose. Even though it uses local JSON storage, this creates unnecessary data collection and persistence that broadens the attack and privacy surface beyond what the skill description justifies.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The module docstring explicitly presents the component as a generic self-evolving learner for any skill, contradicting the manifest's identity as a metacognitive monitoring safeguard. This mismatch is dangerous because deceptive or inaccurate documentation can conceal actual behavior from auditors and users, making risky capability creep harder to detect.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill describes retaining user preferences and learned patterns but provides no warning, consent flow, or retention notice. Undisclosed data retention is dangerous because users may unknowingly expose sensitive habits, errors, or preference data to local persistence that survives beyond the immediate task.

Static analysis

No suspicious patterns detected.