Security audit

prompt-optimizer

Security checks for vulnerabilities and agentic risk

Overview

The prompt optimizer is mostly local and purpose-related, but it includes a persistent generic learning module that can store preferences and notes for arbitrary skill directories beyond the core prompt-optimization task.

Install only if you are comfortable with a local helper that can write optimized prompts, benchmark reports, logs, and learned preference/history files. Review or disable scripts/learner.py if you do not want persistent usage notes or cross-skill preference tracking.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises executable workflows that write files such as prompt.optimized.md, bench.json, and optimize_log.json, yet no permissions are declared. Undeclared write capability undermines least-privilege controls and can lead to unexpected modification of workspace data if the skill is auto-invoked or trusted based on metadata alone.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared purpose is prompt optimization, but the skill also describes a broader learning system that records usage, failures, error types, preferences, and cross-skill insights, including operation on skill directories or ~/.workbuddy/skills. This mismatch is dangerous because users and orchestrators may grant trust for a narrow function while the skill persists telemetry and analyzes unrelated skill data beyond the advertised scope.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The module is explicitly designed as a generic cross-skill learning component and can resolve arbitrary skill directories, including other skills under ~/.workbuddy/skills. That expands data collection beyond the declared purpose of this prompt-optimization skill and creates an unnecessary privacy and scope boundary violation, especially because it records usage history and preferences persistently for any skill name/path supplied.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The code persistently stores user preferences, recent operations, error notes, and capability history in learned_patterns.json without any access control, retention limit beyond the last 20 ops, or demonstrated need for a prompt-optimizer's core function. Free-form note/error fields can capture sensitive user content and create a local behavioral profile over time, increasing privacy and data exposure risk if the file is read by other processes or users.

Ssd 3

Low

Confidence: 89% confidence
Finding: The skill explicitly proposes recording users' commonly used output formats for future default use, which implies cross-interaction retention of user preferences. Persistent storage of behavioral preferences without clear disclosure, retention limits, or consent can create privacy issues and unexpected profiling, especially when combined with the broader learning system described elsewhere.

Static analysis

No suspicious patterns detected.