Security audit

ima真ima

Security checks for vulnerabilities and agentic risk

Overview

The active skill is a coherent IMA knowledge-base organizer, but the package also bundles unnecessary personal workspace artifacts and an old script with a hardcoded export path.

Install only after reviewing and preferably removing the bundled dated workspace snapshot. Expect the skill to scan IMA knowledge-base metadata, optionally fetch full content, write tracker/report/cache files under .workbuddy/ima-tracker, generate index documents, and create a recurring automation task. Use it only for knowledge bases whose content you are comfortable storing locally, and set the output directory deliberately.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill directs the agent to read and write local files (`config.json`, `tracker.json`, reports, caches, and generated documents) but does not declare any permissions or clearly bound those filesystem operations. This creates a trust and review gap: operators may approve or run the skill without realizing it modifies the workspace and user-specified output locations, increasing the chance of unintended data exposure or destructive overwrites.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The documented behavior does not match the actual capabilities described by analysis: the skill may generate extra files, copy outputs to local directories, and depend on preexisting tracker/config state while claiming broader scanning, automation, and RAG functionality. Behavior/description mismatches are dangerous because they prevent informed consent and can hide data-handling or file-copy side effects from users and reviewers.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The script defines a hard-coded absolute destination outside its working directory and later uses it to copy generated documents. This creates an implicit side effect that can exfiltrate or persist knowledge-base outputs into a personal filesystem location without an explicit runtime opt-in, which is risky for automation, multi-user environments, and sensitive document handling.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The code automatically copies every generated document to a fixed personal directory whenever that directory exists, without confirmation or policy checks. In the context of a knowledge-base organization skill, this broadens the data flow beyond index generation and can leak internal or sensitive material into unintended locations, especially when run unattended.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The workflow instructs automatic creation of configuration, tracking, and generated index files, with repeated regeneration and copying to an output directory, but does not prominently warn the user that local files will be created or overwritten. That can lead to accidental data loss, leakage into unintended directories, or persistence of sensitive knowledge-base metadata without clear consent.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The automation instructions schedule periodic scans, content retrieval, local tracking, report generation, and optional caching of fetched content, but they do not disclose the privacy implications of repeatedly processing and storing knowledge-base material. In a knowledge-management context, this can expose proprietary or sensitive content through local caches, reports, or long-lived automation artifacts.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The workflow explicitly caches fetched full document content to a local directory, but it does not require user notice, consent, retention limits, or access controls. Because this skill handles knowledge-base content that may contain sensitive or proprietary text, silent local persistence expands the exposure surface beyond the remote system and can lead to unintended disclosure on the host machine.

Static analysis

No suspicious patterns detected.