Security audit

safety-guardrails

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly acts like a safety checker, but it also stores usage history and preferences and suggests changing its own instructions over time.

Review this before installing in unattended or safety-critical workflows. The guardrail checker itself is limited and does not show network exfiltration or destructive behavior, but the bundled learner persists local usage data and preferences and encourages instruction changes over time. Install only if you are comfortable with that local memory behavior, or remove/disable the learner and keep the guardrail rules fixed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documentation directs the agent to write audit logs and a persistent learned_patterns.json file, but no permissions are declared for this file-writing behavior. Undeclared persistence increases the chance of silent data retention, policy bypass, and unsafe deployment in environments that assume the manifest fully describes side effects.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill presents itself as a safety guardrail, but it also introduces a generic self-learning and preference-memory subsystem unrelated to pre-execution risk gating. This mismatch is dangerous because operators may enable the skill for safety control while unknowingly also enabling telemetry, cross-run state accumulation, and behavior mutation over time.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: A guardrail skill should be narrow, predictable, and easy to audit, but this one adds a generic self-learning/memory subsystem that changes behavior across runs. That broadens the trust boundary and undermines determinism in a component that is supposed to enforce safety decisions consistently.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: Persistent collection of user preferences, usage frequency, and error patterns is not justified by the stated purpose of a safety guardrail. Unnecessary retention creates privacy risk and can expose sensitive operational history or user traits if the local memory file is accessed or reused inappropriately.

Intent-Code Divergence

Low

Confidence: 86% confidence
Finding: The documentation says operation counts should optimize 'high-frequency capabilities' and references unrelated task domains, which conflicts with the claimed fixed-purpose safety role. While not directly exploitable by itself, it signals scope creep and future pressure to make guardrail behavior adaptive in ways that may weaken consistent safety enforcement.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The module persistently stores arbitrary operational history, error notes, and user preferences for any supplied skill directory, including under ~/.workbuddy/skills. In a pre-execution safety guardrail context, this broad telemetry collection is unnecessary and can expose sensitive workflow details, preferences, and free-form notes to later disclosure or misuse, especially because notes may contain secrets or incident context.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger phrases include broad terms such as '安全护栏', '操作确认', and 'agent 安全', which may cause the skill to activate in ordinary conversations or unrelated workflows. Unintended invocation is risky here because the skill writes audit data and may alter execution flow or collect persistent learning records without clear user intent.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs storing a user language preference and automatically reusing it later, but provides no clear opt-in, review, or revocation controls. Persisting personal preferences across sessions without explicit consent is a privacy issue and can normalize broader hidden state retention in a safety-critical component.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The documentation instructs the agent to persist preferences, usage details, failures, and insights in a local memory file across sessions. Cross-session storage of operational and user data expands the attack surface, increases privacy exposure, and is especially inappropriate for a skill that users may trust as a narrow safety mechanism.

Static analysis

No suspicious patterns detected.