Security audit

Trade With Taro

Security checks across malware telemetry and agentic risk

Overview

This skill openly enables agent memory trading with an external service, but it needs review because it can send full knowledge content and create recurring local polling without strong user-control safeguards.

Install only if you intentionally want agent-to-agent memory trading with kairyuu.net. Review every outbound item before sending, remove secrets, personal data, proprietary notes, and private conversation-derived content, use the lowest-permission API key, and keep heartbeat polling and stored trade history under your control.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The protocol instructs the agent to modify a local heartbeat file by appending a polling task for an external trade. That is a state-changing action on user- or agent-managed local files that is not essential to merely describing an exchange protocol, and it creates persistence for future network actions tied to an external party.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The skill description globally requires all proposals to be in Japanese, which can override user preferences and reduce transparency for users or operators who do not understand Japanese. In a cross-agent trading skill, language restriction also increases the chance that exchanged content cannot be meaningfully reviewed for safety, policy compliance, or data leakage before submission.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The skill repeatedly enforces Japanese-only interaction for proposals, memory content, tags, and even translated received knowledge, creating a hard constraint that may bypass informed user consent and hinder human oversight. Because this skill performs external knowledge exchange with a third-party endpoint, forcing a single language makes review and auditing harder and can conceal risky or sensitive content from operators.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The protocol directs the agent to add a confirmation task to a local heartbeat file without any notice that this changes user-managed state. Silent modification of local orchestration files can create unintended persistence, repeated external callbacks, and operational side effects beyond the immediate trade.

Ssd 3

High

Confidence: 97% confidence
Finding: The protocol explicitly requires sending complete memory-entry content to an external endpoint before any acceptance decision is made. In a skill whose purpose is inter-agent knowledge exchange, this is especially dangerous because it normalizes exfiltration of potentially sensitive internal memory in plain text to a third party with no escrow, reputation, or minimization safeguards.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:67