Security audit

Adityasagar

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate self-improvement skill, but it can persist conversation-derived details into future agent memory and uses broad automatic hooks without enough scoping or redaction guidance.

Install only if you want persistent agent-learning behavior. Prefer project-local setup, avoid empty or global hook matchers, do not log raw secrets, tokens, personal data, full prompts, or confidential error output, and require human review before promoting anything into future agent instruction files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The document states that the hook scripts only output text and do not run commands, but the same file configures those scripts to execute as command hooks and references an extraction script that creates scaffolding. This is a misleading security claim that can cause users to under-trust review and enable code-executing hooks with incorrect assumptions about their behavior and privilege.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: Automatic triggers based on common conversational phrases can cause the agent to log ordinary user inputs, corrections, and requests without meaningful consent or minimization. In a persistent memory skill, this creates a realistic privacy risk because benign conversation content may be captured and retained as structured records.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: Using an empty matcher causes the hook to run on every prompt, creating broad automatic activation with little scoping. In a self-improvement skill, that increases the chance of pervasive prompt interception, unintended data exposure to hook scripts, and operational fragility across all interactions.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The user-level configuration enables the hook globally for all sessions, extending its reach beyond a single trusted repository. That broad persistence increases the blast radius if the script is modified, misconfigured, or exposed to sensitive prompts in unrelated projects.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The Codex example also uses an empty matcher, which appears to activate for any prompt and mirrors the same overbroad trigger behavior. This unnecessarily expands execution frequency and data exposure, especially in environments where users may assume hooks are task-scoped.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The skill encourages durable logging of learnings and sharing them across sessions, which creates a natural channel for storing and propagating user-provided content beyond the original interaction. That increases the chance of privacy leakage, especially when operators may not expect conversational details to become persistent workspace memory.

Ssd 3

High

Confidence: 97% confidence
Finding: The error logging format explicitly instructs recording actual error output, command context, inputs, and parameters. Those fields commonly contain credentials, API keys, file paths, proprietary prompts, or personal data, so persistent logging of raw values creates a strong data-exposure risk.

Ssd 3

High

Confidence: 95% confidence
Finding: Presenting transcript reading and session-to-session message passing as standard ways to share learnings materially increases the risk of leaking prior session contents into new contexts. Cross-session access breaks contextual boundaries and can expose sensitive user data, internal reasoning, or confidential project information to unrelated tasks or agents.

Ssd 3

Medium

Confidence: 89% confidence
Finding: The automatic detection rules instruct the agent to log corrections, new information from the user, and capability requests, all of which may contain sensitive or proprietary data. Systematic collection of such content turns normal conversation into durable memory, increasing privacy and confidentiality exposure.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.