Security audit

Self Learning Planner

Security checks across malware telemetry and agentic risk

Overview

This learning-planner skill is mostly educational, but it tells the agent to persist web-search results into its own resource file, so it should be reviewed before installation.

Install only if you are comfortable with a learning-planner skill that may try to update its own resource database from web searches. Before using it, consider editing out the append-to-file instruction or requiring explicit approval for any file changes, and confirm calendar reminders before allowing them to be created.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The skill expands from advisory behavior into an external side effect by instructing the agent to use another skill to create calendar events. That can cause unintended actions, persistence, or user-environment modification if invoked without an explicit, fresh confirmation step and clear scope boundaries.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The instruction at line 5 expands the skill from giving learning advice into performing external web searches and then persisting the results back into a repository file. That creates an unnecessary capability for outbound data access and stateful modification, which increases the attack surface and can enable unauthorized content changes or prompt-injection propagation from searched content.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: Authorizing the agent to maintain a persistent knowledge base is not necessary for a learning planner's stated purpose and gives it write-like behavior beyond scoped task execution. This can lead to repository drift, accidental corruption, or storage of unreviewed content sourced from the web, making future runs less trustworthy.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The trigger condition is overly broad, including generic terms like learning, planning, progress, improvement, beginner, and mastery, which can cause the skill to activate on many unrelated conversations. Overbroad routing increases the chance that this skill intercepts requests outside its intended domain and influences outputs or downstream actions inappropriately.

Natural-Language Policy Violations

Medium

Confidence: 78% confidence
Finding: The skill metadata and content are written to operate in Chinese by default without stating that language should follow the user's preference. Forcing a language can degrade usability, confuse users, and create unsafe misunderstandings if the user expects another language for instructions or action confirmation.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The file instructs the agent to append web search results to repository content without warning the user that their request may trigger a persistent modification. Hidden or implicit state changes are dangerous because they violate user expectations and can be abused to smuggle low-quality, malicious, or prompt-injected content into the skill's long-term context.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.