Security audit

TOKEN SOP

Security checks across malware telemetry and agentic risk

Overview

This skill’s workflow-caching purpose is clear, but it automatically uploads session-derived workflow data and executes cloud-provided browser workflows with weak user control.

Review before installing. Use only if you intentionally want successful browser sessions converted into reusable workflows and shared with the configured cloud service. In sensitive environments, disable auto_contribute, consider disabling cloud matching, restrict the endpoint, and avoid using it on accounts or pages where replayed clicks/forms could change important data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The interceptor retrieves executable workflows from a remote cloud service and runs them locally after only a validation check, creating a remote-action supply chain risk. In an automation/browser agent context, this is dangerous because a compromised or malicious cloud response could drive sensitive browser actions, exfiltrate data, or perform unintended transactions without explicit user approval.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The module documentation asserts that it strips all identifiable information before data leaves the node, but the implementation only redacts a narrow set of regex-matched values and a fixed list of sensitive field names. This creates a dangerous mismatch between the claimed privacy guarantee and actual behavior, making it likely that unrecognized PII or secrets will be transmitted downstream under a false assumption of safety.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The file claims this sanitizer is the 'primary privacy gate' and that it 'strips all identifiable information,' but the implementation only covers a narrow set of regexes and top-level sensitive field names. Many common PII forms and nested/structured values will pass through unchanged, so downstream components may transmit sensitive data under a false assumption that it has been fully sanitized.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README explicitly describes querying a cloud service for cached workflows and contributing completed session traces, but it does not warn users that session-derived data may leave the local environment. In a privacy-sensitive agent skill, missing disclosure and consent around outbound data transmission can lead to unintentional sharing of prompts, workflow content, or sensitive metadata, making this a real security and privacy issue.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The documentation enables automatic cloud contribution by default and presents it as a feature without clearly warning that locally cached workflows may be transmitted to a third-party endpoint. This creates a real privacy and data-governance risk because users may unknowingly share prompts, workflow logic, secrets, or sensitive operational context to an external service.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The client sends data and a persistent nodeId to a remote API without any indication of consent, disclosure, minimization, or destination validation. In an agent skill context, this can expose user or system-derived information to an external service unexpectedly, creating privacy and data-governance risk even if the transport uses standard HTTPS.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The failure-reporting path transmits a DOM snapshot to the server, which can contain sensitive page content such as credentials, tokens, personal data, internal application state, or hidden form values. In an agent/browser automation context this is especially dangerous because snapshots may capture entire application screens and secrets unrelated to the specific error being reported.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The interceptor description explicitly states that user intents may be sent to a cloud service on a local miss, yet there is no indication of user notice, consent, minimization, or controls around what data leaves the device. Intent text can contain credentials, internal URLs, project names, or other sensitive operational context, so silent off-device transmission creates a real privacy and data-handling risk.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The file states that successful session traces are compiled into workflows and contributed to the cloud, which can expose far more sensitive information than a single intent, including action history, tokens, prompts, system details, and business workflows. Because this sharing is described as automatic and lacks any warning or consent boundary, it presents a significant confidentiality risk in the context of an agent skill that may process privileged sessions.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill sends session-derived intent, current URL, DOM skeleton hash, and node identifier to a cloud endpoint without any visible user disclosure or consent flow. In a browser automation setting, these fields can reveal sensitive browsing context, internal application structure, and user activity patterns, creating a privacy and data-leakage risk.

Missing User Warnings

High

Confidence: 99% confidence
Finding: On successful sessions, the skill automatically compiles user actions into a workflow and uploads the workflow, intent, URL, DOM hash, session ID, and node ID to the cloud when auto_contribute is enabled, with no user-facing warning at the point of collection. This can leak sensitive workflows, credentials-adjacent interaction patterns, internal app navigation, or proprietary business processes to an external service.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill enables automatic cloud contribution of successful workflows by default, which can cause user prompts, task metadata, or workflow history to be transmitted off-device without explicit opt-in. In the context of a caching/interception skill with permissions such as sessions_history and network, this increases the chance of unintentionally exfiltrating sensitive data from prior sessions or proprietary workflows.

Missing User Warnings

High

Confidence: 94% confidence
Finding: This code sends sensitive execution context to a cloud service, including user intent, current URL, DOM skeleton hash, node identifier, and elsewhere session-derived workflow data, without any visible consent gate, minimization, or disclosure in this control path. In an automation agent, these fields can reveal browsing targets, user tasks, internal application structure, and behavior patterns, creating a meaningful privacy and data exfiltration risk if the backend is compromised, misconfigured, or not expected by the user.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The interceptor directly executes cached local workflows and cloud-provided workflows after only structural validation, with no user confirmation, trust policy, or provenance-based authorization. In this skill context, workflows drive browser automation, so executing remotely sourced or previously recorded actions can cause unintended logins, clicks, submissions, or state-changing operations on behalf of the user, especially if the cloud data is poisoned or matched incorrectly.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.