Security audit

multi-agent-collab

Security checks for vulnerabilities and agentic risk

Overview

The skill is a local multi-agent orchestration helper with a small local learning log, but no evidence of network exfiltration, destructive actions, or hidden automatic execution.

Install only if you are comfortable with a Chinese-language local CLI skill that can create or update learned_patterns.json files containing operation history, error notes, and preferences. Do not put secrets or sensitive personal data in learner notes or preference values.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: collab.py 与声明基本一致：它实现了角色列表执行、Critic 过滤和 scorer 选优的协作编排流程。但该技能包还包含 learner.py，这不是描述中提到的能力。learner.py 是一个通用、与业务无关的学习模块，可初始化和写入 learned_patterns.json，记录能力调用成败、错误类型、备注和用户偏好，统计高频能力/重复错误，并对任意技能目录（包括 ~/.workbuddy/skills 下的目录）做复盘建议。根据评估标准，只要代码执行了描述未提及的能力就应判为 mismatch；这里额外的持久化学习与跨技能分析能力属于隐藏/未声明行为，因此应标记为不匹配。

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The manifest describes a multi-agent orchestration engine that decomposes problems into roles like Analyst/Critic/Integrator and coordinates proposal, filtering, and integration. This file instead implements a reusable telemetry/learning utility that records usage, preferences, error patterns, and writes learned_patterns.json for arbitrary skills, which is a materially different behavior than orchestrating collaborating agents.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: Persistently recording operation history, recurring errors, notes, and user preferences across skills is a generic profiling/analytics capability. The manifest only justifies orchestrating multiple agents to solve tasks; it does not indicate that the skill should collect and store long-term usage data about other skills or users.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The manifest description and primary user-facing documentation are entirely in Chinese, with no indication that the skill supports other languages or that Chinese is an intentional region-specific requirement. Under the language/locale policy, a skill should not implicitly force a specific language without user opt-in or documented justification.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: This code persists learned data to learned_patterns.json, including recent operations, error notes, and user preferences. Although the module docstring describes recording behavior, the write path itself lacks a user-facing disclosure or warning that potentially sensitive notes/preferences will be stored on disk.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The module description, CLI help text, and runtime messages are written exclusively in Chinese, with no indication that users can choose another language. This creates a locale/language policy issue because the skill effectively enforces one language without opt-in or documented justification.

Static analysis

No suspicious patterns detected.