self-play-coevolution

• Outcome: Review
• Latest audit: Aug 14, 2026 · 1:47 AM UTC
• Version: 1.0.0

Overview

The skill’s core self-play demo is harmless, but it also adds persistent local learning and preference storage that is broader than its stated purpose and lacks clear consent or retention controls.

Review before installing. The self-play script itself appears local and non-networked, but the learning module is designed to keep cross-run memory about usage, errors, notes, and preferences. Install only if you are comfortable with that local persistence, and consider disabling learner.py usage or clearing learned_patterns.json when using shared or sensitive environments.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill documents file-writing behavior via `scripts/learner.py` and explicit writes to `learned_patterns.json` and potentially `SKILL.md`, but the manifest does not declare permissions or clearly scope that capability. Undeclared write access is dangerous because consumers may invoke the skill expecting only reasoning/self-play behavior while it silently persists data or modifies local files.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is self-play coevolution, but the documentation adds persistent telemetry, preference storage, reflection, and repository write-back behavior that is outside that core function. This mismatch undermines informed consent and can conceal privacy-invasive or state-changing operations users would not expect from the skill’s description.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill documentation expands behavior from self-play into a persistent self-learning system that records history, preferences, and writes improvements back to files, none of which is reflected in the main manifest purpose. Hidden secondary capabilities increase risk because operators may not review or constrain the data collection and mutation features appropriately.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Persisting user preferences and usage telemetry is not necessary to perform proposer/critic coevolution, so the data collection is overbroad relative to stated purpose. Excess collection increases privacy risk, creates retention obligations, and broadens the blast radius if local data is exposed or later reused unexpectedly.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documented behavior adds a generic persistent learning and memory subsystem that is materially broader than the skill’s stated self-play proposer/critic purpose. Capability drift like this is dangerous because it can introduce hidden data collection and stateful behavior that users and reviewers would not expect from the metadata, reducing informed consent and increasing the chance of misuse.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: Persisting user preferences, usage counts, and error history is not necessary for a self-play coevolution skill as described, so it represents unjustified expansion of scope. In this context, the mismatch makes the memory behavior more dangerous because it appears incidental rather than clearly required, which can conceal privacy-impacting functionality inside an unrelated skill.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill says usage outcomes and preferences are automatically persisted locally, but it does not provide a clear user warning or consent flow for that storage. Silent retention of natural-language notes and errors can capture sensitive information and surprise users who believed the interaction was ephemeral.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs writing improvements back into `SKILL.md`, which modifies repository files without a strong warning or approval step. Self-modifying documentation or repo content can introduce integrity issues, accidental corruption, or stealthy propagation of unsafe instructions over time.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill states that a local JSON file stores usage totals, capability frequency, error patterns, user preferences, and improvement suggestions, but provides no retention or privacy warning. This is dangerous because operational history and preferences can reveal sensitive behavioral information, and users are not informed that their data will persist across runs.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The instructions tell the operator to save user preferences for automatic future reuse, but do not clearly warn that subsequent runs will silently apply those preferences. This can cause unintended behavior, profiling, or disclosure of prior-user context, especially in shared environments where future users may not realize state from earlier sessions persists.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The design calls for persistent collection and reuse of user preferences, errors, and notes in a local memory file, which creates a natural-language data retention risk. Such files often accumulate sensitive contextual details that may later be exposed to other tools, users, backups, or prompts without proper access control or minimization.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: Directing the skill to persist user preferences for future automatic reuse creates a data retention risk in natural-language instructions, even without complex code. The danger is amplified here because the skill is framed as self-improving, which can normalize ongoing accumulation of user-specific state without adequate limits, consent, or deletion controls.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The iteration rule explicitly instructs the system to write important user preferences into a memory file for later reuse, formalizing persistent profiling behavior. This is risky because it operationalizes indefinite carryover of user-specific data into future interactions without user-by-user isolation, consent boundaries, or retention constraints.

Static analysis

No suspicious patterns detected.