Security audit

open-ended-goal-discovery

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a local goal-ranking utility, but it adds persistent preference tracking and suggests modifying its own skill instructions without clear user approval or tight scoping.

Install only if you are comfortable with the skill keeping local usage and preference history. Keep learner.py pointed at this skill's own directory, avoid automatic SKILL.md rewrites unless a human reviews the change, and periodically delete or reset learned_patterns.json if you do not want cross-session profiling.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented purpose is open-ended goal discovery and ranking, but the described behavior also includes persistent logging, preference storage, threshold-based reflection, and self-modification of the skill document. This mismatch is dangerous because users and orchestrators may approve the skill for low-risk recommendation tasks while it performs hidden stateful and mutating actions that materially change privacy and integrity risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest describes a skill that proactively discovers new goals from capability graphs, user-interest signals, and feedback, then scores candidates on value, novelty, feasibility, and user alignment. This module instead records per-skill usage, preferences, recurring errors, and emits simple reflection suggestions; there is no goal-candidate generation, four-dimensional scoring, ranking, or Top-N recommendation logic.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill instructs use of scripts/learner.py to persist state and even rewrite SKILL.md, which implies file-write capability, but it declares no tool scope or permission boundary. Missing explicit permissions increases the chance an agent will grant broader filesystem access than users expect and obscures the real risk surface of the skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The self-improvement workflow introduces persistent memory and automatic mutation of the skill's own documentation, which goes beyond a local ranking module. Self-modifying behavior can erode auditability, enable prompt/instruction drift over time, and make later executions behave differently from the reviewed version.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill stores user preference data and acceptance/rejection history in learned_patterns.json, but the primary description does not clearly warn users about this persistence. Hidden retention of behavioral and preference data creates privacy risk and undermines informed consent, especially when the data is reused across future runs.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill directs persistent storage and reuse of user preferences and acceptance/rejection history without clear minimization, retention, or scope boundaries. Over time this can accumulate sensitive behavioral profiles, and the lack of limits makes misuse, over-collection, and unintended cross-session inference more likely.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Rewriting the skill documentation based on runtime outcomes is not justified by the stated task of discovering and ranking goals. Unnecessary self-modification expands the attack surface and can be abused to alter future instructions, conceal prior behavior, or bypass expected review workflows.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This is a code file, so natural-language policy checks apply to docstrings and user-visible text. The module description and usage instructions are presented only in Chinese, with no indication that language selection is optional or region-specific, which can violate a language/locale policy requiring user choice.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script accepts an arbitrary skill directory path or skill name and then reads/writes learned_patterns.json under that location without restricting it to the current skill or validating an allowed root. This enables unintended modification of state across other installed skills and potentially arbitrary filesystem locations writable by the current user, which is dangerous in an agent ecosystem because one skill can mutate another skill's persistent data outside its declared purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The printed runtime messages are all hard-coded in Chinese and there is no user opt-in or configuration for language preference. For an all-purpose utility module, this is a natural-language locale constraint rather than a clearly justified regional requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The natural-language description and usage guidance are presented entirely in Chinese, and there is no indication that the skill is region-specific or that users may choose another language. Per the stated policy, forcing a specific language without opt-in is a language/locale policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This manifest-style JSON includes natural-language values such as "目标发现" for capability names, but provides no indication that the user can opt into this language or that the locale restriction is intentional. Under the policy rule for language/locale, forcing a specific language without user choice can be a policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code file contains user-facing natural-language documentation and CLI usage text only in Chinese, which can impose a language choice on users without opt-in. The stated policy flags language-forcing behavior unless the skill offers a language choice or clearly justifies a locale-specific scope.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.