Security audit

statistics

Security checks for vulnerabilities and agentic risk

Overview

The statistics tool is mostly local and purpose-aligned, but it includes an automatic learning logger that persistently records usage details and can write state outside the skill's own directory.

Review this skill before installing. The statistics calculation code is local and conventional, but the bundled learner records local history, notes, errors, and preferences, and can write that state for other skill directories if invoked that way. Avoid putting sensitive dataset details in learner notes, or disable/remove the learner unless you explicitly want persistent usage tracking.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documentation instructs the agent to invoke a learner component that records results after analysis, which implies write-capable behavior not declared in the skill metadata. Undeclared persistence expands the trust boundary and can surprise operators, especially in environments that rely on declared permissions for sandboxing or policy enforcement.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill is ներկայացված as a pure offline statistics tool, but the documented learner behavior adds telemetry-like logging, persistent state, and cross-skill pattern tracking that are outside the declared purpose. This mismatch is dangerous because users and policy systems may approve the skill for low-risk data analysis while overlooking hidden collection and retention behavior.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The document claims the skill is for offline, zero-dependency statistical analysis, yet it also directs post-analysis recording and retrospective learning. Even if local-only, this broadens data handling from transient computation to persistent storage, increasing the risk of retaining sensitive dataset-derived details or user behavior without clear expectation.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The file's stated behavior is a generic cross-skill learning and telemetry system, which materially differs from the declared purpose of a statistics skill that should analyze CSV/JSON datasets. This kind of scope mismatch is dangerous because it introduces hidden data collection and capability expansion that users and reviewers would not reasonably expect from the manifest, increasing the risk of unauthorized profiling and persistence.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The code persistently writes usage history, errors, notes, and user preferences to learned_patterns.json, which is outside the advertised analytics-only scope. Persistent storage of behavioral data can create privacy, compliance, and data-minimization issues, especially when notes may contain sensitive user or task information.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: resolve_skill_dir accepts arbitrary directory paths and also resolves arbitrary skill names under ~/.workbuddy/skills, enabling this module to read from and write to other skill directories. In context, that creates cross-skill boundary violations and lets a statistics skill modify unrelated skills' state files, which is broader access than its declared function requires.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The module performs behavioral profiling, recurring-error aggregation, and self-optimization recommendations unrelated to statistical analysis of user-provided datasets. While not directly code-execution dangerous, this expands the skill into covert monitoring and adaptive behavior, which increases privacy risk and weakens trust because it is hidden behind an unrelated skill label.

Static analysis

No suspicious patterns detected.