Security audit

reflection-replanner

Security checks for vulnerabilities and agentic risk

Overview

The replanning skill appears locally functional, but it adds persistent self-learning and possible skill-file mutation beyond the stated replanning purpose.

Review this skill before installing. The replanner itself is local and simple, but the bundled learning feature keeps local history, errors, notes, and preferences, and the instructions suggest updating the skill instructions over time. Install only if you are comfortable with that persistence, and avoid recording secrets or sensitive workflow details in notes or error messages.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documents file-write capability via `scripts/learner.py` and persistent writes to `learned_patterns.json`/`SKILL.md`, but no permissions are declared in the manifest. That creates an authorization and transparency gap: a caller expecting a replanning-only skill may unknowingly invoke stateful filesystem writes, which can persist sensitive task data or alter skill behavior over time.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose is reflection-driven replanning, but the documentation adds a persistent self-learning subsystem that records usage history, errors, notes, and user preferences. This materially expands the data-processing surface beyond user expectations, increasing privacy risk and enabling silent accumulation of sensitive operational or personal data unrelated to replanning.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The documentation broadens the skill from a failure-analysis replanner into a persistent learning system that records historical usage and writes back knowledge. This is a scope-creep issue that can surprise downstream agents and users, because a planning helper now also acts as a stateful telemetry and mutation component.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: Storing user preferences and cumulative usage/error history is not necessary for the core function of classifying failures and revising plans. Collecting extra state without strong justification increases privacy exposure and the chance that sensitive notes, errors, or behavioral profiles are retained longer than intended.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The skill claims it only revises step lists and does not modify implementation details, yet later instructs writing experience back into `SKILL.md`. That inconsistency is risky because self-modifying documentation/configuration can alter future agent behavior, create prompt-injection persistence, and make the skill's effective behavior diverge from reviewed content.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The file presents itself as a generic cross-skill 'self-evolution learning module' that records usage, failures, notes, and preferences to persistent storage, which does not match the stated purpose of a reflection-driven replanning skill. This kind of capability drift is dangerous because it introduces undisclosed telemetry and stateful behavior into a skill whose expected function is planning/reflection, increasing the chance of covert data collection and making security review harder.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code explicitly supports long-term collection of operation history and user preferences across arbitrary skill directories via a generic CLI interface. Even without exfiltration code, this creates an unnecessary aggregation point for behavioral data beyond the skill's direct mission, which can expose sensitive habits, error notes, or preferences if the local filesystem is accessed by other components or users.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill states that user preferences and cumulative usage/error history are stored and reused, but provides no warning about privacy, retention, or downstream reuse. In context, this is more dangerous because the stored notes and error descriptions may naturally contain sensitive user or task data, and the skill is public-facing.

Natural-Language Policy Violations

Medium

Confidence: 83% confidence
Finding: The example command persists `输出语言=中文` as a reusable preference without presenting it as an optional, consent-based choice. While not severe by itself, forced preference persistence can override user intent across sessions and demonstrates a pattern of silently storing personalization data.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The module writes user preferences, error notes, and recent operation records to disk in learned_patterns.json without any warning, consent flow, or documentation of persistence behavior. Persisting free-form notes is particularly risky because users or upstream tools may place secrets, personal data, or sensitive workflow details into those fields, which then remain on disk indefinitely.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The instructions direct the skill to retain user preferences, usage notes, and error context for future reuse, creating a natural-language data retention channel. Free-form notes are especially risky because they can capture secrets, personal data, or confidential workflow details that are then persistently stored without sanitization.

Static analysis

No suspicious patterns detected.