Security audit

open-ended-curriculum

Security checks for vulnerabilities and agentic risk

Overview

The curriculum generator itself is simple, but the skill also adds persistent user profiling and self-modification instructions that need review before installation.

Install only if you are comfortable with the skill keeping local usage history, preferences, error notes, and possibly modifying its own SKILL.md instructions through agent action. Prefer a version where persistence is opt-in, limited to this skill, easy to inspect and delete, and where prompt/instruction changes require explicit human review.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill documents file-writing behavior via `scripts/learner.py` and `learned_patterns.json` but does not declare corresponding permissions. Undeclared persistence weakens operator visibility and consent, and can enable unexpected local state changes or data retention when the skill is used in a broader agent environment.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose is curriculum generation, but the documentation also introduces a separate stateful learning system that records usage history, preferences, and error patterns for arbitrary skill directories. This mismatch is dangerous because reviewers or users may authorize the skill for low-risk content generation while it also performs persistent profiling and local data management beyond the stated scope.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The later section materially expands the skill from a simple generator into a persistent self-learning and user-profiling system. Hidden stateful behavior increases risk because it can accumulate user data over time and alter future behavior in ways not obvious from the primary skill description.

Description-Behavior Mismatch

High

Confidence: 94% confidence
Finding: The implementation does not match the declared purpose of an open-ended curriculum generator; instead it provides a generic cross-skill learning/telemetry component. That mismatch matters because it expands the skill’s effective scope and creates hidden persistence behavior that users and reviewers would not reasonably expect from the manifest, undermining transparency and trust boundaries.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The code stores persistent usage history, error notes, and arbitrary user preferences for any supplied skill directory, including under ~/.workbuddy/skills. This broad, undeclared data collection increases privacy risk and enables overcollection beyond the stated curriculum use case; free-form notes may also capture sensitive user content that is then retained on disk without access controls or retention limits.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The documented 'self-learning' subsystem adds persistent profiling and behavioral accumulation that goes beyond the skill’s stated purpose of generating open-ended curricula. Expanding a skill into cross-session memory and adaptation without clear scope limits increases privacy risk, creates hidden state that affects future behavior, and broadens the attack surface beyond what a user would reasonably expect.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill instructs storage of user preferences, operation counts, error patterns, and usage frequency in a local memory file for future reuse, but this telemetry is not clearly necessary for curriculum generation. This creates avoidable long-term profiling and data retention risk, especially if the stored data includes sensitive user habits, failures, or inferred preferences without notice or consent.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The instruction to 'write experience back into this SKILL.md' grants the skill a self-modification path that can alter future behavior and embedded instructions outside normal review. Self-editing documentation or prompts is dangerous because it can persist prompt injection effects, weaken safeguards over time, and make the skill drift from its reviewed and approved state.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill describes persistent storage of usage outcomes and user preferences in `learned_patterns.json` without a clear warning, consent flow, or retention notice. Silent local profiling is risky because users may unknowingly leave behind preference or behavioral data that can later be accessed, reused, or leaked.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation introduces persistent storage of usage history and user preferences without any corresponding user warning or transparent disclosure. Hidden persistence is risky because users may reveal information under the assumption of stateless operation, leading to consent, privacy, and trust failures.

Ssd 3

Medium

Confidence: 95% confidence
Finding: Persistently recording preferences, usage counts, and error patterns creates a retention surface for natural-language data that may reveal user habits, workflows, or sensitive context over time. In an agent environment, such local memory files can be unintentionally exposed to other tools, logs, backups, or future sessions.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The examples explicitly encourage writing free-text error messages and notes, which can easily capture sensitive user content, filenames, document details, or operational secrets. Because these notes are persisted, accidental collection of sensitive data becomes likely even if the skill's main purpose is benign curriculum generation.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The section explicitly directs persistent storage of preferences, failures, notes, and usage details in a local memory file for future interactions. Persistent cross-session memory can expose sensitive data, enable unnoticed profiling, and create data leakage paths if the file is accessed by other tools, users, or later prompts.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: SKILL.md:40