teacher-capability-probe

• Outcome: Review
• Latest audit: Aug 14, 2026 · 1:48 AM UTC
• Version: 1.0.0

Overview

The skill’s core probe tool is local and coherent, but it also includes an unrelated persistent memory module that can store usage history, free-form notes, errors, and user preferences.

Install only if you are comfortable with the skill keeping a local memory file of usage history, errors, notes, and preferences. Do not put secrets, personal data, customer details, or sensitive business context in learner notes or preferences, and consider disabling or deleting learned_patterns.json if you only need the teacher-probe functionality.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares no permissions, yet its documented behavior includes persistent file writes via `learned_patterns.json`. This creates a transparency and policy-enforcement gap: operators may trust the manifest while the skill can still persist data locally, including usage history and preferences, which increases the chance of unauthorized retention or misuse.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The stated purpose is teacher capability probing, but the documentation also adds a generalized learning/memory subsystem that records operational history, errors, notes, and user preferences for arbitrary skill directories. This mismatch is dangerous because it hides broader data-collection and persistence behavior behind a benign evaluation use case, undermining informed consent, review, and least-privilege assumptions.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The self-evolving user-memory subsystem is unrelated to the declared teacher-evaluation function and introduces persistent statefulness that can collect and reuse user or operational data over time. In this context, the extra subsystem expands the attack and privacy surface without a clear functional need, making the skill more dangerous than its manifest suggests.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The instructions explicitly tell the skill to store user preferences and operational history, but that capability is not justified by evaluating teacher-model boundaries. Unnecessary storage of preferences and history can accumulate sensitive or identifying information and enable silent profiling or cross-task leakage.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file implements a generic self-learning and telemetry mechanism for arbitrary skills, which materially exceeds the declared purpose of a teacher capability probe. In this context, scope creep is security-relevant because it creates persistent data collection and cross-skill state management unrelated to the advertised evaluation function, increasing privacy and misuse risk.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The code writes learned_patterns.json, preferences, notes, and operation history into any provided directory or into ~/.workbuddy/skills/<name>, enabling persistent telemetry across arbitrary skills. This is dangerous because a component presented as an evaluator can silently accumulate user preferences and behavioral data outside its stated scope, and the target path is only weakly constrained.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The data model includes arbitrary preferences, recent operations, notes, and error patterns for any skill, which is unjustified for a teacher capability probe. Such broad logging can capture sensitive behavioral metadata and free-form notes, creating unnecessary privacy exposure and a foundation for cross-skill profiling.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill describes automatic persistence of usage data and preferences without warning users that their information may be retained locally. Lack of notice is dangerous because users and reviewers may unknowingly expose sensitive workflow details, error content, or personal preferences to long-lived storage.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The examples encourage recording free-form error notes and user preferences to a local file, which can easily capture secrets, personal data, or sensitive business context. Because the notes are unconstrained and persisted, this creates a realistic risk of overcollection and later disclosure or misuse.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill promotes persistent collection and reuse of user preferences and history without limiting what categories of user-provided information may be stored. Unbounded local memory is dangerous because it invites accidental retention of confidential, personal, or security-relevant data and can influence future behavior in opaque ways.

Static analysis

No suspicious patterns detected.