Security audit

unified-world-model

Security checks for vulnerabilities and agentic risk

Overview

The core world-model code is harmless, but the skill also includes cross-session learning that persistently records usage and preferences without clear limits or controls.

Review this skill before installing if you do not want persistent local records of skill usage, error notes, or preferences. The core world-model script does not show network or destructive behavior, but the learning subsystem should be treated as local telemetry and should ideally be opt-in, scoped to this skill, and easy to clear.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill advertises operational capabilities that include file writing, but the manifest declares no corresponding permissions. This creates a transparency and governance gap: a host or user may allow the skill under the assumption it is read-only, while it can persist data to disk and alter local state.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented purpose is a grounded multimodal world model, but the skill also includes a generic self-evolution/learning subsystem that persistently records outcomes, preferences, and patterns across sessions. That materially expands the trust boundary from simulation to telemetry and retention, increasing privacy, compliance, and abuse risks because users are not clearly informed that broader behavioral data may be stored.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The file implements a generic cross-skill telemetry and learning CLI that is materially broader than the declared purpose of a unified multimodal world model. This creates a hidden capability for collecting operational history across skills, which expands the attack surface and violates least-privilege expectations for a skill whose manifest describes modeling and consistency checking rather than persistent behavioral logging.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The code stores user preferences, recent operations, error notes, and per-capability history in a persistent JSON file without any clear need tied to the advertised world-model behavior. Even if not immediately exfiltrating data, this can accumulate sensitive workflow metadata and user-specific information that later components or other skills could misuse.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The markdown explicitly states that each invocation is recorded into a cross-session self-evolution loop, but it provides no warning about retention, what data is stored, or privacy consequences. In context, this skill processes multimodal observations that may include tool outputs, code results, and potentially sensitive operational context, so silent persistence can capture more than users expect.

Static analysis

No suspicious patterns detected.