Security audit

self-eval

Security checks for vulnerabilities and agentic risk

Overview

This skill is an offline self-evaluation scorer with optional local report and learning files, and the persistence is disclosed and user-invoked.

Before installing, understand that this skill can save evaluation reports and local learning records. Use the learner commands only when you want persistent local notes or preferences, and do not put secrets, private user content, or sensitive evaluation material into --note, --key, or --val.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documentation instructs use of commands that write reports and learning data to disk, but the skill declares no permissions. This creates a transparency and policy gap: operators may invoke a seemingly harmless scoring skill without realizing it persists data locally, which can lead to unintended storage of model outputs, user content, or evaluation artifacts.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The stated purpose is a self-evaluation scorer, but the documented behavior expands into persistent recording, preference storage, reflection, and learned-pattern maintenance. That mismatch is dangerous because users and higher-level orchestrators may grant trust or invoke the skill for narrow evaluation purposes while it also performs stateful data collection and behavior shaping not implied by the description.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The 'self-evolving learning system' section materially broadens the skill from offline scoring to ongoing recording, insight generation, and reflection workflows backed by persistent state. In context, this increases risk because evaluation content often contains sensitive user outputs, and persistent learning features can silently accumulate those artifacts beyond the immediate task boundary.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The implementation materially diverges from the declared skill purpose: instead of only scoring outputs with a rubric, it provides a generic cross-skill learning and telemetry mechanism. That mismatch is dangerous because it expands the trust boundary and introduces covert state accumulation and behavior-shaping capabilities that users and calling agents would not reasonably expect from a self-evaluation skill.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: This code persists operational history, errors, notes, and preferences to disk in a local JSON file, which exceeds the stated evaluation-only scope. Persistent collection of interaction metadata creates privacy and integrity risks, especially when a user invokes a skill expecting ephemeral scoring rather than ongoing tracking.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The script can record arbitrary key/value preferences for any target skill directory, which is broader than a rubric scorer needs and can be repurposed to store unexpected user profiling data. Because keys and values are unconstrained, the feature enables silent accumulation of sensitive or manipulative state without a clear product justification.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The module is explicitly designed as a reusable self-improving component for arbitrary skills, not as a one-shot self-evaluation tool. In this context, that broader capability is risky because it enables unadvertised memory, optimization feedback loops, and potential cross-skill influence under the cover of a much narrower manifest.

Static analysis

No suspicious patterns detected.