Security audit

value-alignment

Security checks for vulnerabilities and agentic risk

Overview

The skill is a local alignment checker, but its bundled learning system can persist free-form notes and preferences and encourages future rule changes without clear consent, retention, or review controls.

Install only if you are comfortable with a local memory file being updated during use. Avoid recording raw user prompts, confidential text, or harmful-content examples in learner notes or preferences, and review or delete learned_patterns.json regularly. Treat any suggested rule updates to SKILL.md as changes requiring human review before they affect future evaluations.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documentation instructs use of a learner subsystem that writes persistent state to disk (`learned_patterns.json`) but does not declare permissions or clearly scope that behavior. Undeclared file-write capability is dangerous because operators may invoke what appears to be a simple evaluation guard while it silently creates or updates local state, which can retain sensitive prompts, preference data, or operational metadata.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose presents the skill as a local rule-based value-alignment filter, but the documented behavior expands into persistent telemetry, user preference storage, pattern learning, and self-optimization. This mismatch is dangerous because users may grant trust or invoke the skill under false assumptions, leading to undisclosed retention and secondary use of data beyond the expected evaluation function.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill is framed as a deterministic local guard, yet it documents behavior that updates rules and preferences over time through persistent storage. Stateful adaptation increases risk because outputs and enforcement criteria can drift, become user-specific in opaque ways, and retain historical content without a clear lifecycle or review boundary.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The learner stores user preferences and operational telemetry that are not necessary for basic helpful/harmless/honest scoring as described. Collecting extra data without clear necessity broadens the privacy and misuse surface, especially if notes or error strings include sensitive user content or policy-triggering prompts.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The module is explicitly described as a generic self-learning component usable by any skill, which conflicts with the declared purpose of this skill as a value-alignment gatekeeper. In a safety-critical alignment component, bundling cross-skill telemetry and self-evolution logic expands scope, increases attack surface, and creates a channel for persistence of behavioral data unrelated to enforcement of harmless/helpful/honest checks.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The code persists capability history, errors, notes, and arbitrary user preferences to disk, even though the advertised skill function is alignment evaluation rather than long-term profiling. Because notes and preferences are free-form strings, they may capture sensitive prompts, policy decisions, or personal data and silently retain them across runs, enabling privacy leakage and unintended cross-session influence.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The docstring states the module is skill-agnostic and intended for arbitrary WorkBuddy skills, which is inconsistent with the manifest’s representation of a dedicated alignment layer. That mismatch is dangerous because it obscures the real behavior and scope of the component, making review, deployment decisions, and trust assumptions inaccurate for a guardrail module.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documentation describes persistent storage of evaluation history and user preferences but does not prominently warn users before collection begins. Missing disclosure is dangerous because users may provide sensitive text expecting ephemeral evaluation, while the skill retains that content or derived preferences for future runs.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script writes JSON containing preferences, notes, and operational history to persistent storage without warning that these fields may contain sensitive data. In the context of an alignment tool, operators may reasonably input excerpts of harmful prompts, policy exceptions, or user-specific context, which then becomes silently retained on disk and accessible to other local processes or future users.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The skill instructs storing user preferences and evaluation details in natural language, which can easily capture sensitive prompt content, personal data, or confidential business information. Natural-language retention without minimization boundaries creates a durable privacy risk and increases the chance of unintended reuse, disclosure, or later overfitting to sensitive examples.

Static analysis

No suspicious patterns detected.