Security audit

native-autonomous-discovery

Security checks for vulnerabilities and agentic risk

Overview

The skill’s core discovery script is local and coherent, but it also adds persistent user-memory and skill self-modification instructions that are broader than the stated purpose.

Review this before installing. The discovery script itself is local, but the skill also asks the agent to keep cross-session memory in learned_patterns.json and to update skill instructions based on accumulated experience. Install only if you are comfortable with local preference/history retention, and avoid storing sensitive notes or allowing automatic SKILL.md edits without review.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documentation describes file-writing behavior via the learner subsystem (`learned_patterns.json` and possible SKILL.md updates) while the manifest declares no permissions. This creates a transparency and consent gap: users and hosting platforms may treat the skill as read-only discovery logic when it can persist data and alter local files.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The stated purpose is autonomous hypothesis discovery, but the documentation also introduces persistent logging, user preference retention, cross-run analytics, and operation over arbitrary skill directories. That mismatch is dangerous because it obscures secondary data-collection and file-manipulation behaviors that a user would not reasonably expect from a local zero-dependency research loop.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: A persistent self-evolution subsystem changes the privacy and security profile of the skill from a one-shot local analysis tool into a stateful tracker across runs. Even if local-only, retaining history and preferences increases the risk of unintended data accumulation, profiling, and misuse beyond the core task.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: Storing user preferences and usage history is not necessary to perform autonomous hypothesis generation and evidence scoring. Unnecessary retention broadens the attack surface and creates privacy risk if notes, errors, or preferences contain sensitive user or task information.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The instruction to write accumulated experience back into `SKILL.md` introduces self-modifying behavior affecting the skill's own documentation/instructions. Self-modification can corrupt trusted configuration, create prompt-injection persistence across runs, and allow unreviewed changes to alter future agent behavior.

Description-Behavior Mismatch

High

Confidence: 89% confidence
Finding: The file implements a generic cross-skill telemetry and learning component that is materially broader than the manifest-described autonomous discovery workflow. In practice, this creates an undeclared persistence and data collection surface across skills, which can store user preferences, notes, and operational history without a clear need tied to the stated capability, increasing the risk of covert data retention and misuse.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The code adds reusable preference and operation logging features unrelated to the advertised autonomous-discovery function, enabling collection of arbitrary keys, values, notes, and error metadata. Because these fields are unconstrained and persisted to disk, the module can become a catch-all store for sensitive or unnecessary user and workflow data, which expands privacy and abuse risk.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The documentation introduces a persistent learning and memory subsystem that goes beyond the stated autonomous discovery purpose and adds stateful behavior across runs. This expands the skill’s data-handling and operational scope, creating privacy, retention, and unintended self-modification risks that are not clearly bounded or justified by the core scientific workflow.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill documents collection of usage counts, error patterns, and user preferences without showing why this data is necessary for the stated scientific discovery function. Unnecessary collection increases privacy exposure and creates a durable profile of user behavior that could be reused beyond the original task.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation instructs persistent storage of preferences and error notes without warning users about retention, scope, or privacy implications. This is dangerous because users may disclose sensitive information in free-form notes or preferences without realizing it will be saved for future sessions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation describes persistent storage of user preferences and usage history without any privacy warning, consent notice, or retention explanation. In context, this is more dangerous because the skill’s primary purpose is scientific discovery, not user profiling, so users would not reasonably expect cross-session memory collection.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The instructions encourage writing learned experience back into SKILL.md, which normalizes modification of skill files without warning or review. Even if intended for improvement, self-modifying or user-influenced documentation/code paths can lead to integrity issues, prompt injection persistence, or unsafe drift over time.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The skill explicitly instructs retention of user preferences for future sessions in a local memory file, creating durable state tied to user behavior. Persistent memory can enable silent profiling, accidental storage of sensitive information, and unexpected cross-session influence on outputs.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The workflow explicitly persists user preferences and usage details across sessions in a local memory file, creating a durable natural-language record that may contain sensitive or identifying information. Because this retention is cross-session and not clearly scoped, it increases privacy risk and potential misuse if the file is accessed, repurposed, or allowed to grow unchecked.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The instructions encourage saving user preferences for automatic reuse in future interactions, which promotes retaining user data beyond the immediate session. In this skill context, such persistence is not clearly necessary for autonomous discovery and therefore enlarges privacy and profiling risk without strong justification.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The iteration rule explicitly instructs writing important user preferences into persistent storage for future automatic use, establishing a retention mechanism that can silently shape later behavior. This is risky because it stores potentially personal behavioral data and applies it later without guaranteed fresh consent or visibility.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/discover.py:92