Security audit

task-decomposition

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local task-planning helper with optional local learning files; its persistence is disclosed and user-invoked, though users should avoid recording sensitive notes.

Install only if you are comfortable with a local planning skill that can create WBS output files and, when you explicitly use learner.py, save usage notes and preferences in learned_patterns.json. Do not record secrets, private prompts, credentials, or sensitive business details as learner notes or preferences.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill advertises itself as a local rule-based task decomposer, but the documented commands write output files such as wbs.json and wbs.md without any declared permissions. Undeclared file-write capability weakens the trust boundary, because a caller may invoke a seemingly harmless planning skill that can still persist data to disk.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This is a significant description-behavior mismatch: besides decomposition, the skill includes a self-learning subsystem that records usage statistics, failures, notes, preferences, and writes learned_patterns.json under the skill directory or ~/.workbuddy/skills. Hidden persistence and profiling are dangerous because users invoking a planning tool would not reasonably expect long-term storage of behavioral data or automatic reflection logic.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The script implements a generic cross-skill learning/telemetry component that records usage, errors, notes, and preferences for arbitrary skills, which is materially different from the manifest’s stated purpose of local task decomposition/WBS generation. This mismatch expands the skill’s effective privileges and data-handling behavior beyond user expectations, increasing the risk of covert data retention and cross-skill profiling.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The code persists preferences and operational history for any supplied skill directory, not just this task-decomposition skill. In context, that creates an unnecessary cross-skill state store that can accumulate behavioral data and free-form content unrelated to the advertised feature, violating least privilege and increasing privacy risk.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The module is explicitly designed to retain user preferences and free-form notes from interactions, and stores them in plain JSON without minimization or consent controls. Because the skill context is only task decomposition, this retention is not clearly necessary and could preserve sensitive user content for later disclosure through insights or reflections.

Ssd 3

Medium

Confidence: 95% confidence
Finding: Recent operations capture arbitrary note and error content and keep a rolling history that can later influence outputs via insight/reflect commands. This creates a straightforward path for retaining and replaying user-provided or sensitive content, including prompt material, mistakes, or private context, beyond what a task-decomposition skill needs.

Static analysis

No suspicious patterns detected.