Security audit

super-agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local orchestration loop that runs bounded subprocesses and stores local progress/memory files, with no evidence of hidden exfiltration, destructive behavior, or install-time execution.

Install only if you want a local, stateful orchestration skill. Avoid putting secrets or sensitive business data in goals or preferences unless you are comfortable with them being written to local JSON/JSONL files, and review/delete generated state, report, memory, and learned-pattern files when needed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises and documents shell execution and file-writing behavior while declaring no permissions, which breaks least-privilege expectations and can cause users or platforms to invoke a capability set broader than they realize. In this context, the skill is a meta-agent that orchestrates subprocesses and persistent state, so undeclared execution and write capabilities are especially risky because they enable arbitrary command execution chains and disk modification through a high-autonomy loop.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 86% confidence
Finding: The documented purpose frames the skill as an orchestration loop, but the behavior includes broader persistent learning, preference management, and error-statistics storage that materially expands data handling and autonomy. That mismatch is dangerous because users may consent to planning/execution but not to cross-run profiling or hidden local knowledge-base growth, especially in a self-improving agent that compounds capabilities over time.

Vague Triggers

Medium

Confidence: 76% confidence
Finding: The activation criteria are extremely broad—essentially any ambitious task where autonomous long-running progress is desired—which encourages over-invocation of a powerful, self-directed skill. In a high-autonomy agent loop with planning, execution, reflection, and memory, vague invocation guidance increases the chance of the skill being applied to sensitive contexts without appropriate user confirmation or tighter scoping.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill states that it supports resumable execution via persisted state but does not clearly warn users that task state will be written to disk and may contain sensitive goals, intermediate outputs, or operational context. For a long-horizon autonomous agent, persisted state can reveal user intent, workflow history, or derived knowledge across runs, creating confidentiality and retention risks.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The markdown describes cross-session memory retention without warning that preferences, prior interactions, and failure patterns may be stored and reused later. In a self-improving agent, this memory can silently accumulate sensitive behavioral data and influence future decisions in ways the user did not explicitly approve.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill documents real subprocess execution of other scripts without warning users about command execution, even though subprocess invocation materially changes the trust and risk model. In this meta-agent context, chaining external scripts from an autonomous loop magnifies danger because unexpected inputs or compromised subskills could lead to command execution, data access, or side effects beyond the user's understanding.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: The skill describes writing reports and learned-pattern files but does not clearly warn users that new files will be created and incrementally populated over time. While lower impact than command execution, undisclosed file creation can still leak sensitive task details, clutter shared environments, or create persistent telemetry-like artifacts of user activity.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The script persists user preferences directly to learned_patterns.json without any notice, consent flow, minimization, or safeguards around sensitivity of stored values. In this skill context, the module is explicitly designed for continual memory and cross-use learning, which increases the likelihood that operators will store personal, behavioral, or otherwise sensitive data that may later be read by other local processes or users with filesystem access.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The agent persistently stores goal-related state and memory to local files without any notice, consent, retention control, or data minimization. Because goals may contain sensitive business or personal data, silent persistence can create privacy leakage, forensic exposure, and unintended cross-session data reuse.

Missing User Warnings

Medium

Confidence: 78% confidence
Finding: This orchestrator silently executes other skill scripts as subprocesses, expanding the trust boundary without informing the user which components are being invoked. In an agent context, hidden tool delegation is risky because downstream skills may access data, perform network actions, or persist artifacts beyond what the user expects.

Static analysis

No suspicious patterns detected.