Security audit

structured-extraction

Security checks for vulnerabilities and agentic risk

Overview

The JSON extraction helper is mostly straightforward, but it adds a persistent learning log that can save free-form usage notes and preferences on disk.

Install only if you are comfortable with a local persistent learning file. Avoid recording sensitive document contents, personal data, credentials, or confidential workflow details in learner notes or preferences, and periodically review or delete learned_patterns.json if you use that feature.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill documents file read/write capable helper scripts but does not declare corresponding permissions, which weakens transparency and policy enforcement. In an agent environment, undeclared filesystem access can surprise users and enable unintended writes such as creating or modifying local JSON state files.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The advertised purpose is structured extraction and JSON repair, but the skill also includes a persistent learner subsystem that records usage history, failures, notes, and cross-session patterns in learned_patterns.json. That behavior materially expands data collection and persistence beyond user expectations, creating privacy, retention, and scope-creep risks if sensitive extraction inputs or metadata are logged.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The documented self-evolution subsystem introduces persistent cross-session memory that is unrelated to the core extraction function. Even if framed as optimization, such memory can accumulate operational details, error traces, and potentially sensitive workflow context across runs, increasing privacy and misuse risk.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Persistent cross-session learning is not necessary for a structured extraction utility and therefore violates the principle of least functionality. Unnecessary memory creates an avoidable attack and privacy surface, especially if extraction tasks involve documents, PDFs, or other potentially sensitive content.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: This file implements a generic cross-skill persistence and self-improvement subsystem rather than functionality narrowly required for structured extraction. In the context of an extraction skill, collecting usage history, errors, and preferences creates unnecessary state and broadens the data footprint, increasing privacy and misuse risk if sensitive extracted content or user behavior is recorded.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The module persistently stores operational history, error notes, recent operations, and arbitrary user preferences in learned_patterns.json with no access control, minimization, or purpose justification for a structured-extraction skill. Because notes and preference values are free-form, operators may inadvertently store sensitive document contents, personal data, or workflow metadata that persists on disk indefinitely.

Static analysis

No suspicious patterns detected.