Security audit

open-ended-goal-discovery

Security checks for vulnerabilities and agentic risk

Overview

The skill’s core local ranking is coherent, but it needs Review because it can persist user feedback and tells the agent to modify its own skill file without clear approval or reset controls.

Review before installing. This does not show network exfiltration or destructive behavior, but it can keep a local history of preferences, notes, and outcomes, and its instructions may lead an agent to edit the skill’s own SKILL.md after repeated feedback. Use it only if that local memory is acceptable, avoid recording sensitive notes, and require explicit approval before any SKILL.md modification.

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill documentation describes file-writing behavior through its self-improvement workflow, but the manifest does not declare corresponding permissions. This creates a capability/permission mismatch that can mislead users and orchestrators about the skill’s real side effects, especially because it later instructs rewriting SKILL.md and persisting learned data.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The manifest presents the skill as a pure local ranking/discovery module, but the body introduces persistent storage of user interaction history and preferences plus self-modification of SKILL.md. That discrepancy hides meaningful privacy and integrity impacts from users, making the skill more dangerous because it appears stateless while actually accumulating data and changing project files.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The core mechanism section frames the skill as operating on a provided JSON input, suggesting a bounded stateless computation, but later sections add automatic post-run learning, retention, and file rewrites. This inconsistency can cause reviewers or users to underestimate side effects and approve the skill in contexts where persistent state or file mutation is not acceptable.

Description-Behavior Mismatch

Medium

Confidence: 83% confidence
Finding: The module persistently stores user preferences, operation history, notes, and error metadata to disk in skill directories, but this behavior is not disclosed by the skill description. Undisclosed persistence creates a privacy and trust risk: sensitive notes or preference data may be retained longer than expected, inspected by other local processes/users, or reused across contexts without informed consent.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill states that it records operation counts, acceptance/rejection history, user preferences, and improvement suggestions in a persistent file, but provides no privacy notice, consent flow, retention policy, or minimization guidance. This is risky because even seemingly low-sensitivity behavioral data can reveal user interests and decisions over time.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs automatic rewriting of SKILL.md based on usage outcomes without prominently warning the user that project files may be modified. Unannounced self-modification threatens file integrity, complicates auditing, and can be abused to silently change future behavior or documentation.

Static analysis

No suspicious patterns detected.