Security audit

social-collaboration-mind

Security checks for vulnerabilities and agentic risk

Overview

The core collaboration strategy tool is simple, but the skill also directs persistent local logging of usage, errors, notes, and preferences without clear consent, retention, or reset controls.

Install only if you are comfortable with the skill keeping a local memory file about usage, failures, notes, and preferences. Avoid recording sensitive task details or user-upload characteristics, and consider removing or disabling scripts/learner.py and learned_patterns.json unless you explicitly want cross-session personalization.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documentation instructs use of a learner module that writes persistent state (`learned_patterns.json`) but the skill declares no permissions for file writing. This creates an undeclared capability gap that can mislead operators and policy systems about what the skill will modify on disk.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The advertised purpose is collaboration-strategy selection, but the skill also includes a generic cross-skill learning and persistence subsystem that records usage history, failures, preferences, and insights for arbitrary skill directories. This hidden expansion of scope increases privacy and integrity risk because users may invoke the skill expecting stateless decision support, not durable profiling and filesystem modification.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The self-learning/experience-logging subsystem exceeds the core function of selecting collaboration strategies and introduces persistent state, behavioral profiling, and post-hoc modification guidance. Even if intended as convenience, this materially broadens the trust boundary and creates opportunities for unauthorized data accumulation or cross-session influence.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The module is explicitly designed as a generic cross-skill learning/telemetry component rather than functionality narrowly tied to the advertised social-collaboration purpose. That broad persistence layer enables collection of usage history, failures, notes, and preferences across arbitrary skills, expanding data collection and retention beyond user-expected scope and increasing privacy and abuse risk if reused elsewhere.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: This code persistently writes behavioral logs, free-form notes, error history, and user preferences to learned_patterns.json without any access control, redaction, consent flow, or purpose limitation. Because notes and preferences may contain sensitive user or operational data, the file can become an unintended local telemetry store and a privacy leak surface disproportionate to the skill's stated collaboration-strategy role.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The skill documentation introduces a persistent self-learning subsystem that materially expands the skill's behavior beyond its stated collaboration-strategy purpose. This creates hidden state, cross-session behavior drift, and a larger privacy/security surface that users and reviewers may not expect, making misuse or unsafe retention easier to overlook.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill describes persistent storage of user preferences, usage history, errors, and improvement suggestions without any visible privacy notice, consent model, minimization guidance, or retention policy. Such silent persistence can expose sensitive operational or personal metadata and create compliance issues, especially in collaborative or enterprise environments.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill documents persistent storage of usage history, error patterns, and user preferences without any privacy notice, consent boundary, or retention policy. This is dangerous because it normalizes collection of potentially sensitive behavioral data across sessions without making users aware of how long it is kept or how it will influence future behavior.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The instructions tell operators to record user preferences for automatic future reuse, but do not warn that this alters future behavior based on retained user data. This creates a hidden personalization channel that can surprise users, entrench stale preferences, and retain personal data beyond the immediate task.

Natural-Language Policy Violations

Medium

Confidence: 82% confidence
Finding: The example hard-codes Chinese as a saved output-language preference without presenting it as a user choice. While lower severity than broader retention issues, it still demonstrates silent persistence of a user-specific setting and may cause behavior changes that the user did not request.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The instructions explicitly encourage persisting user preferences and usage-derived information across sessions, which creates durable state that can influence future behavior without renewed user awareness. In this skill's context, that persistence is not necessary for the core collaboration-decision function and therefore increases privacy, manipulation, and data-leakage risk.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The content instructs the skill to keep user preferences and usage-derived notes across sessions, creating a persistent natural-language memory mechanism without clear minimization or consent limits. Such retention can accumulate sensitive or identifying data over time and expand the blast radius if the file is later accessed, reused, or mishandled.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The failure-logging example encourages saving notes about user-upload characteristics, which can normalize storing details about user-provided content in persistent logs. Even seemingly harmless notes can reveal sensitive document attributes, workflow patterns, or other personal/business context when accumulated over time.

Ssd 3

Low

Confidence: 90% confidence
Finding: This instruction explicitly saves user preferences for future automatic use, implying ongoing retention of user-specific data across sessions. The security risk is real but somewhat narrower than broader history/error logging because the example concerns a single preference rather than richer behavioral data.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The iteration rules direct the system to write important user preferences into a persistent file for future automatic reuse, formalizing an ongoing retention channel. Because this is framed as a rule rather than an optional action, it increases the likelihood of silent long-term profiling and behavior changes without user awareness.

Static analysis

No suspicious patterns detected.