Security audit

super-agent-integration

Security checks for vulnerabilities and agentic risk

Overview

The main integration runner is local and purpose-related, but the skill also adds persistent self-learning memory for preferences, errors, and notes without clear limits or consent.

Review this before installing. The core runner appears to perform local agent-integration testing, but the self-learning add-on creates durable memory about usage, failures, notes, and preferences. Install only if you are comfortable with that local persistence, avoid storing secrets or sensitive task details in learner notes, and prefer disabling or removing the learner/writeback behavior unless you explicitly want cross-session memory.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill documentation describes file-writing behavior via learned_patterns.json and possibly modifying SKILL.md, yet no permissions are declared. Undeclared write capability is dangerous because it can surprise operators, bypass least-privilege expectations, and enable persistence or tampering if the skill is run in a broader agent environment.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The manifest presents the skill as an orchestration/evaluation tool, but the body adds a general-purpose self-learning subsystem that records usage history, errors, and user preferences. This mismatch is dangerous because reviewers and users may approve the skill for one purpose while it silently performs long-term data collection and persistence outside the expected trust boundary.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The embedded self-learning system persists usage history and preferences across runs, but this capability is not reflected in the manifest's stated scope. Hidden stateful behavior increases the risk of unauthorized retention, cross-session profiling, and misuse of data in environments expecting a transient evaluation-only tool.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Storing long-term user preferences and operational history is not clearly necessary for the stated task of verifying and measuring an autonomous agent loop. Collecting more data than needed violates data minimization principles and expands the blast radius if the file is exposed, reused, or interpreted by other agents.

Intent-Code Divergence

Low

Confidence: 74% confidence
Finding: The documentation inconsistently states that experience may be written back into SKILL.md while also naming learned_patterns.json as the memory file. Ambiguity around writable targets is risky because it can permit self-modifying instructions, documentation tampering, or broader file modification than operators expect.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The module accepts an arbitrary skill_dir path and then reads from and writes to learned_patterns.json under that location without constraining it to an approved skill root. In a system where other components pass user-influenced paths, this enables unintended file creation or overwrite anywhere the process has access, expanding the skill's reach beyond its declared scope.

Context-Inappropriate Capability

Low

Confidence: 82% confidence
Finding: The skill documents persistence of user preferences and operational history beyond the narrowly stated super-agent integration purpose. This broader retention increases the chance that unnecessary user data is collected and reused across sessions, creating privacy and data-minimization risks.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill claims automatic recording of user preferences and outcomes without any privacy notice, consent flow, or retention policy. This is dangerous because users may unknowingly disclose sensitive operational details that are then stored persistently and potentially reused or exposed later.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The markdown instructs persistent storage of user preferences, error patterns, and operational history without any disclosure of retention scope, purpose, or duration. Users may unknowingly have personal or behavioral data retained across uses, which is a clear privacy weakness.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The example tells the system to save and automatically reuse a language preference of Chinese without establishing that the user explicitly opted in. Persisting and replaying preferences by default can violate user expectations and trains the system to retain profile data unnecessarily.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The instructions direct persistence of user preferences and usage details across runs in plain language, creating a durable record that may contain sensitive or identifying information. In agent ecosystems, such files can be read by other components, leaked through logs/backups, or reused in unintended contexts.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The example commands encourage recording free-form error strings and notes, which can easily capture secrets, personal data, file paths, or proprietary task content. Free-form persistent notes are especially risky because they are hard to sanitize reliably and may later be surfaced to users or other agents.

Ssd 3

Medium

Confidence: 95% confidence
Finding: Persisting user preferences and operational notes across uses creates a durable natural-language storage channel that may capture personal, sensitive, or task-specific information. Because the stored content appears broadly defined, it can become an unbounded cross-session memory sink.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The failure-recording example encourages saving free-form notes about user uploads, which can easily include sensitive content, filenames, document characteristics, or other identifying details. Free-text retention is especially risky because it is hard to constrain and may later be reused in unintended contexts.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The instruction to write accumulated experience back into the skill file risks promoting retained user-derived information into persistent instructions or documentation. That can spread sensitive data beyond the learning store and make it harder to detect, review, or delete, increasing long-term exposure.

Ssd 3

Medium

Confidence: 95% confidence
Finding: Directly reusing 'important user preferences' on future calls establishes ongoing retention and replay of user-supplied information without sensitivity limits or expiry. In the context of an autonomous agent skill, this cross-session memory behavior is more dangerous because the data may influence future actions automatically and opaquely.

Static analysis

No suspicious patterns detected.