Security audit

neuro-symbolic-reasoning

Security checks for vulnerabilities and agentic risk

Overview

The skill provides a small neuro-symbolic reasoning demo, but it also adds persistent local learning and self-modification instructions that are broader than the stated reasoning purpose.

Install only if you are comfortable with the agent keeping local usage memory for this skill. Avoid recording confidential prompts, filenames, client data, credentials, or personal details in notes/preferences, and inspect or clear learned_patterns.json periodically. The self-learning and SKILL.md rewrite instructions should be disabled or made explicit opt-in before normal use.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documents file-writing behavior via a persistent learning subsystem but does not declare corresponding permissions. Undeclared write capability undermines the trust boundary for the skill and can lead to silent persistence of usage data, preferences, and notes without host-level review or user awareness.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The manifest presents the skill as a neuro-symbolic reasoning tool, but the documentation adds a generic telemetry/memory subsystem that records usage history, failures, notes, and preferences. This mismatch can mislead users and reviewers, causing them to approve a reasoning skill while unintentionally allowing data collection and persistence beyond the stated purpose.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The documented self-learning subsystem introduces a second, generic capability set—persistent memory, profiling of usage, and improvement logic—not implied by the core reasoning function. This expands the attack and privacy surface because free-form errors, notes, and preferences may accumulate sensitive natural-language data over time.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: Persistent collection of user preferences and historical usage is not clearly necessary to perform neuro-symbolic inference. Collecting and retaining data without a tight purpose limitation creates avoidable privacy and retention risk, especially if error strings or notes contain sensitive context from prior tasks.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The unified query layer claims it will explicitly mark conflicts between symbolic and neural conclusions, but the implementation always returns conflict=False and never compares the symbolic conclusion against the neural label. In systems that rely on this flag for trust calibration or escalation, contradictory soft evidence can be silently suppressed, causing downstream components or users to overtrust a result marked as verifiable.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill describes automatic persistence of usage history and user preferences without warning that these fields may contain sensitive or identifying information. Absent disclosure and data-handling guidance, operators may store confidential task content, error details, or personal preferences in plaintext local files.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The module persists user preferences, operation history, error notes, and free-form notes to disk in learned_patterns.json without consent flow, warning, minimization, or protection controls. Those fields can easily contain sensitive data, and storing them in plaintext makes unintended disclosure through local access, backups, logs, or support bundles more likely.

Ssd 3

Medium

Confidence: 96% confidence
Finding: Persistently recording preferences, errors, and notes in a local natural-language memory file creates a clear data retention and leakage risk. Free-form text often captures sensitive prompts, filenames, operational details, or personal information, and local persistence increases exposure to later unintended access or reuse.

Static analysis

No suspicious patterns detected.