Workflow Cache

• Outcome: Review
• Latest audit: May 29, 2026 · 9:26 PM UTC
• Version: 1.0.3

Overview

This skill does what it says, but it automatically sends sensitive session-derived workflow data to a cloud service and runs cloud-supplied browser workflows with limited user control.

Review this carefully before installing, especially in workspaces involving credentials, internal sites, customer data, or regulated information. Disable auto_contribute if available, avoid using it on sensitive sessions, and only use the cloud endpoint if you trust the publisher and its handling of workflow, URL, intent, session, and failure telemetry.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The skill advertises cost savings via cached workflows, but the described behavior includes broad interception of user intents, execution of cloud-provided workflows, and upload/reporting of session-derived data to an external service. That creates a significant trust-boundary violation: remote content can influence local automation, and users may unknowingly share operational metadata or trigger unintended actions beyond the stated purpose.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The code automatically compiles successful session traces into workflows and uploads them to a cloud service, despite the skill being marketed primarily as a caching and cost-saving feature. Session traces, intents, URLs, and derived workflows can encode sensitive user behavior and site-specific interactions, creating a material data exfiltration and privacy risk beyond what a user may reasonably expect.

Context-Inappropriate Capability

Low

• Confidence: 82% confidence
• Finding: The skill sends detailed execution failure information, including raw error text, to the cloud. Error messages often contain sensitive application state, selectors, URLs, user-provided values, or tokens, so transmitting them externally can leak information unrelated to the advertised caching purpose.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README explicitly describes querying a cloud service before local exploration and contributing successful session traces back to a shared registry, but it does not warn users that session-derived data may be transmitted off-device. Even if a PII sanitizer exists, the absence of clear disclosure, consent, and limits on what is uploaded creates a real privacy and data-governance risk because users may assume their sessions remain local.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Enabling auto-contribution by default sends workflow-derived information to a cloud service without a clear, prominent warning at the point of configuration. Even if the skill claims PII sanitization, session traces, metadata, failures, or workflow patterns can still expose sensitive business logic, browsing targets, internal URLs, or user behavior.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The match() method serializes the full request object and sends it to a remote cloud endpoint, which can expose prompts, workflow data, or other sensitive inputs to a third party without any visible user disclosure or consent mechanism in this code path. In an agent skill marketed around cloud-cached workflows, this materially increases privacy and data-governance risk because users may assume local processing while their data is transmitted off-box.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The contribute() path posts request data to the cloud service, likely uploading workflow artifacts or agent interaction data for shared caching, again without any visible disclosure, consent, or filtering in this client. This creates a clear risk of unintended exfiltration of proprietary prompts, credentials embedded in requests, or regulated data to an external service.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The reportFailure() method sends failure-related request data to a remote endpoint without any visible notice or minimization, which can leak operational details, inputs, or error context externally. Although typically lower sensitivity than primary workflow contribution, failure reports often contain diagnostic context that may still reveal sensitive prompts, identifiers, or internal behavior.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: The declaration comments explicitly state that the skill queries a cloud service on every user intent and uploads completed workflows, but there is no accompanying indication of consent, disclosure, minimization, or controls. In the context of an agent skill, that behavior can expose user prompts, session content, or derived workflows to a remote service without the user's awareness, creating privacy and data-governance risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The interface documentation explicitly describes sending user intents, session traces, success/failure telemetry, and compiled workflows to a cloud service, but there is no indication of user notice, consent, minimization, or controls around what data leaves the local environment. In an agent framework, intents and traces can contain sensitive credentials, internal URLs, proprietary workflows, or personal data, so undisclosed transmission creates a real privacy and data-governance risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The cloud match request transmits normalized user intent, current URL, DOM skeleton hash, and node metadata without any user-facing notice or consent in this execution path. In an agent/browser context, these fields can reveal browsing targets, tasks, and environment fingerprints, enabling privacy loss and potential cross-session tracking.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: Successful sessions are automatically contributed to the cloud along with workflow and session-derived data, with no visible warning or consent mechanism here. Because workflows are compiled from actual user actions, they may capture sensitive operational steps, internal application structure, or personal/business data, making automatic upload particularly dangerous in a browser automation skill.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The manifest defaults to automatically contributing successful workflows to a cloud service, but it provides no user-facing disclosure about what workflow data may leave the local environment. In a skill that also requests session history and network access, this creates a real risk that prompts, task context, or sensitive workflow artifacts could be transmitted off-device without informed consent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill requests both sessions_history and network permissions while advertising cloud-cached workflows, yet the manifest does not explain how session data may be accessed, processed, or sent to the remote endpoint. That combination materially increases the chance of sensitive user conversations, internal prompts, or operational metadata being exfiltrated or mishandled.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.