Security audit

小花自我迭代 (HuaNiu Enhanced)

Security checks across malware telemetry and agentic risk

Overview

This skill is not clearly malicious, but it asks agents to persist and re-inject user/session learnings broadly without enough scoping or consent guidance.

Install only if you are comfortable with an agent keeping durable notes about your sessions and potentially reusing them later. Before enabling hooks or memory promotion, restrict them to trusted projects, review what gets written to .learnings and MEMORY/SOUL/TOOLS/AGENTS files, and avoid storing secrets, credentials, personal data, or confidential business details.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The document's security section states that the scripts only output text and do not run commands, but the hook configuration explicitly invokes shell commands via the hook system. This mismatch can mislead users into underestimating the trust and execution risks of enabling the hooks, causing them to run unreviewed local scripts with their agent's permissions.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill instructs the agent to write to persistent local files such as .learnings and MEMORY.md, but it does not clearly require explicit user consent before modifying workspace state. In agent environments, silent persistence can create integrity, privacy, and surprise-modification risks, especially when notes may include sensitive prompts, errors, or operational details.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: An empty matcher makes the UserPromptSubmit hook fire for every prompt, creating an always-on trigger with no scope restriction. In a self-improving skill, this broad trigger increases the chance of persistent prompt injection, unintended context manipulation, or excessive execution of local scripts across all workstreams.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The user-level configuration enables global activation from the home directory, causing the hook to run across projects and sessions without meaningful scoping. This widens the blast radius of any buggy, compromised, or overly aggressive hook behavior and makes persistence harder for users to notice and audit.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The Codex CLI example repeats the same empty matcher pattern, so the hook executes on any prompt rather than only relevant ones. That broad activation is risky because it normalizes automatic command execution on every interaction, increasing exposure to prompt-driven abuse or accidental interference.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation instructs promotion of session-derived learnings into persistent workspace files like MEMORY/TOOLS/AGENTS/SOUL without any warning about retention, visibility, or sensitive-data handling. In an agent environment, this can cause accidental storage of secrets, private user content, or internal operational details that later sessions will re-ingest, amplifying exposure over time.

Ssd 3

Medium

Confidence: 94% confidence
Finding: This section encourages promoting user teachings and preferences into long-term memory files, which creates a data retention risk if personal, confidential, or security-relevant information is stored in plain language. Persistent memory can later be disclosed to other tasks, operators, or tools beyond the context in which the data was originally shared.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The workflow instructs broad scanning of user messages, emotion/tone analysis, and promotion of findings into persistent memory and logs without clear limits on sensitive content. That combination increases the chance of over-collection, profiling, and long-term storage of information the user did not expect to be retained.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The best-practice guidance says to 'actively promote' information and even add uncertain material to MEMORY.md, which encourages indiscriminate retention and increases the risk of storing inaccurate or sensitive user data. Over time, this can contaminate long-term memory, propagate false assumptions, and expose private information across future sessions.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.