Security audit

static-deploy

Security checks for vulnerabilities and agentic risk

Overview

The deployment helper is mostly coherent, but it bundles a persistent cross-skill learning tool that records notes and preferences more broadly than a static-site deploy skill needs.

Review this skill before installing. The deployment checker is reasonable for a static-site workflow, but the learning script can store local history, errors, preferences, and notes in skill directories. Avoid putting secrets, internal URLs, credentials, or incident details in notes, and consider removing or disabling learner.py unless you specifically want this persistent cross-skill tracking behavior.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill references local scripts and a deployment workflow that implies filesystem access, yet it declares no explicit permissions or guardrails for reading and writing files. In a deployment context, undeclared file access is risky because the skill also instructs checking build artifacts and learning-state files, which can lead to accidental access to sensitive files or silent persistence beyond the user’s expectation.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The stated purpose is static-site deployment, but the skill also includes a generic 'self-learning' system that records usage, stores user preferences, analyzes failures, and reads or writes learned_patterns.json for arbitrary skill directories. This expands the data collection and persistence surface beyond deployment, creating a meaningful risk of unauthorized profiling, cross-skill state manipulation, or modification of files outside the user’s expected scope.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The file is explicitly a generic cross-skill 'self-evolution' and telemetry component, not a static deployment helper. In a deployment skill, bundling reusable usage tracking across arbitrary skills expands the data collection surface and capability scope beyond what users would reasonably expect, increasing privacy and trust risks.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: This code persists operational history, free-form notes, error patterns, and user preferences to disk for any supplied skill directory, including under ~/.workbuddy/skills. That creates a cross-skill profiling mechanism unrelated to deployment, and the free-form note field can capture sensitive data that is then retained without safeguards.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The executable behavior exposed by the CLI is a generic analytics/optimization tool ('init', 'record', 'prefer', 'insight', 'reflect') rather than a static site deployment workflow. Scope mismatch is dangerous because users and reviewers may grant trust or permissions based on the manifest, while the shipped code performs unrelated persistent tracking across skills.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The module writes user preferences and free-form notes directly to learned_patterns.json without any warning, consent flow, minimization, or protection. Because notes can contain arbitrary operator-entered text, this can silently store credentials, internal URLs, incident details, or other sensitive context on disk.

Static analysis

No suspicious patterns detected.